EUVD-2026-30963
GHSA-g2r5-mmrr-v3jg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible login requires no prior privileges or victim interaction; scope changed because admin SCADA access can cascade to connected industrial systems.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
AnalysisAI
Hard-coded administrative credentials in ScadaBR 1.2.0 expose SCADA systems to unauthorized admin-level access via the network-accessible web interface. An unauthenticated remote attacker who knows the embedded credentials - discoverable through documentation, advisory disclosure, or reverse engineering - can authenticate directly as administrator without any legitimate credential. Reported by ICS-CERT (ICSA-26-139-03) and catalogued under EUVD-2026-30963, this flaw is rated automatable by SSVC, raising particular concern in operational technology environments where admin access can translate to physical process manipulation.
Technical ContextAI
ScadaBR is an open-source SCADA (Supervisory Control and Data Acquisition) platform used in industrial control and automation environments. CWE-798 (Use of Hard-Coded Credentials) describes a class of flaw where static credentials are compiled into or shipped with the application and cannot be changed through normal configuration - the application accepts them regardless of operator intent. The CPE cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:* covers the ScadaBR application; the EUVD confirms version 1.2.0 specifically. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects that the SCADA web interface is network-reachable with no prerequisite access conditions. Subsequent-system impacts (SC:L/SI:L) in the CVSS 4.0 vector acknowledge that admin-level SCADA access can cascade to connected industrial devices or processes beyond the software itself.
RemediationAI
Consult the ICS-CERT advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03 for vendor-specific patching instructions, as a confirmed fixed version is not identified in the available data - patch availability per vendor advisory should be assumed until confirmed otherwise. As compensating controls pending a patch: restrict network access to the ScadaBR web interface using firewall rules or VLAN segmentation so only trusted internal hosts can reach it (trade-off: limits operator remote access); place any internet-accessible ScadaBR deployment behind a VPN requiring strong multi-factor authentication before the SCADA interface is reachable (trade-off: adds operational overhead); investigate whether the application allows the hard-coded account to be disabled or its credentials overridden at the application or database level. Enable logging of all authentication events and alert on logins using known default credential patterns. Note that none of these controls remove the embedded credentials from the binary - only a vendor-released patch addresses the root cause.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe
OS command injection in ScadaBR 1.2.0 lets an authenticated attacker execute arbitrary operating-system commands as root
Sensor-data injection in ScadaBR 1.2.0 lets an unauthenticated attacker forge arbitrary sensor readings by sending craft
Cross-site request forgery in ScadaBR 1.2.0 lets a remote attacker execute any authenticated action by luring a logged-i
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attac
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/
Remote code execution in ScadaBR allows authenticated users to abuse exposed server-side methods to create and execute a
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. Rated m
Reflected cross-site scripting in ScadaBR's URL handling allows unauthenticated remote attackers to inject and execute a
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today