EUVD-2026-30959
GHSA-p7j8-3xc2-rm45
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CSRF needs no attacker auth (PR:N) but requires luring an authenticated victim (UI:R); forged privileged actions yield high C/I/A with no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
3DescriptionCVE.org
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
AnalysisAI
Cross-site request forgery in ScadaBR 1.2.0 lets a remote attacker execute any authenticated action by luring a logged-in operator to a malicious web page, which silently submits forged requests under the victim's session. Because ScadaBR is a SCADA/HMI platform, forged actions can alter data points, configuration, and control logic, giving state-changing impact on industrial processes. No public exploit has been identified at time of analysis and the EPSS score is very low (0.02%), but CISA ICS-CERT triaged it as high severity (CVSS 4.0 8.6) with 'total' technical impact.
Technical ContextAI
ScadaBR is an open-source SCADA (Supervisory Control and Data Acquisition) and HMI web application used for industrial monitoring and control, addressed by CPE cpe:2.3:a:scadabr:scadabr. The root cause is CWE-352 (Cross-Site Request Forgery): the application's state-changing HTTP endpoints do not require an unpredictable, per-request anti-CSRF token, so the server cannot distinguish a request intentionally issued by the user from one forged by a third-party site that rides the browser's automatically-attached session cookie. Any browser-authenticated session (an operator logged into the ScadaBR web console) can therefore be abused to perform privileged actions the attacker selects.
RemediationAI
No vendor-released patch version is identified in the provided data, so first consult the CISA ICS advisory ICSA-26-139-03 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03) for any upgrade or mitigation guidance and apply a fixed release if one is published. As compensating controls: remove ScadaBR web consoles from direct Internet exposure and place them behind a VPN or segmented ICS/OT network so the console origin is unreachable from arbitrary web pages; require operators to use a dedicated browser/workstation that is not used for general web browsing, which breaks the lure step; enforce short session timeouts and explicit re-authentication so idle authenticated sessions cannot be silently ridden; and, where the deployment allows, front the application with a reverse proxy that adds SameSite=Strict/Lax session cookies and Origin/Referer validation to reject cross-site state-changing requests. Trade-offs: browser and network isolation add operational friction for operators, SameSite cookies may break legitimate embedded or cross-origin integrations, and aggressive session timeouts increase re-login frequency in control-room settings.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
OS command injection in ScadaBR 1.2.0 lets an authenticated attacker execute arbitrary operating-system commands as root
Sensor-data injection in ScadaBR 1.2.0 lets an unauthenticated attacker forge arbitrary sensor readings by sending craft
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attac
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/
Remote code execution in ScadaBR allows authenticated users to abuse exposed server-side methods to create and execute a
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. Rated m
Hard-coded administrative credentials in ScadaBR 1.2.0 expose SCADA systems to unauthorized admin-level access via the n
Reflected cross-site scripting in ScadaBR's URL handling allows unauthenticated remote attackers to inject and execute a
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today