EUVD-2026-30960
GHSA-jvgx-g9vj-2c98
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network GET with no user interaction gives AV:N/AC:L/PR:N/UI:N; forged sensor data yields high integrity and availability impact but no confidentiality disclosure (C:N).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
AnalysisAI
Sensor-data injection in ScadaBR 1.2.0 lets an unauthenticated attacker forge arbitrary sensor readings by sending crafted HTTP GET requests to the SCADA system, because the data-writing function performs no authentication (CWE-306). Reported by ICS-CERT and tracked as ICSA-26-139-03, the flaw carries a CVSS 4.0 base of 8.8 driven by high integrity and availability impact; there is no public exploit identified at time of analysis and EPSS is low (0.08%), but CISA SSVC rates it automatable, meaning attacks could be scripted at scale against exposed instances.
Technical ContextAI
ScadaBR is an open-source SCADA/HMI (supervisory control and data acquisition / human-machine interface) platform used to collect, visualize, and log data points from industrial field devices. The affected component (CPE cpe:2.3:a:scadabr:scadabr) exposes an HTTP endpoint that accepts data-point updates. The root cause is CWE-306, Missing Authentication for Critical Function: a critical operation - writing sensor/point values into the historian and live data model - is reachable over plain HTTP GET without any credential check, session, or token. Because the operation is idempotent-looking and expressed as a GET, it can be triggered by a simple URL fetch, requiring no CSRF token, no POST body, and no prior session state.
RemediationAI
No vendor-released patched version is identified in the available data, so remediation should center on compensating controls pending guidance in CISA ICSA-26-139-03 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03). Remove the ScadaBR HTTP interface from any internet exposure and place it on an isolated OT/ICS network segment; restrict access to the data-ingestion endpoint to known, authorized poller/collector hosts via firewall or reverse-proxy allow-listing (trade-off: legitimate remote clients must be enumerated and maintained). Put an authenticating reverse proxy (mutual TLS or HTTP auth) in front of ScadaBR so the unauthenticated GET cannot be reached directly (trade-off: added operational complexity and possible integration work with existing pollers). Monitor for anomalous or out-of-range sensor values and unexpected GET requests to data-point URLs to detect injection attempts. Confirm the exact fixed version with the vendor/CISA before assuming an upgrade path exists; do not deploy an unverified version number.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
OS command injection in ScadaBR 1.2.0 lets an authenticated attacker execute arbitrary operating-system commands as root
Cross-site request forgery in ScadaBR 1.2.0 lets a remote attacker execute any authenticated action by luring a logged-i
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attac
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/
Remote code execution in ScadaBR allows authenticated users to abuse exposed server-side methods to create and execute a
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. Rated m
Hard-coded administrative credentials in ScadaBR 1.2.0 expose SCADA systems to unauthorized admin-level access via the n
Reflected cross-site scripting in ScadaBR's URL handling allows unauthenticated remote attackers to inject and execute a
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today