JSON-SCADA EUVD-2026-108130

Exploitation requires an authenticated JSON-SCADA account (PR:L) with network access to the OPC HistoryRead API handled by opcApi() in src/server_realtime_auth/index.js; the attacker must be able to submit a HistoryReadRequest and control the NodeId.Id, StartTime, or EndTime values, which are concatenated into the backend SQL query and support stacked statements. The specific feature required is the OPC historian HistoryRead API. The main limiting factor is that valid credentials are needed (not unauthenticated), so an attacker must first obtain or possess an account; however, the flaw explicitly works 'regardless of role,' so no elevated privilege or special configuration is required beyond basic authenticated access, and default deployments appear affected. No user interaction is required.

This is a genuine high-severity issue but not a drop-everything emergency. The CVSS 4.0 base score of 8.7 is driven by network reachability (AV:N), low attack complexity (AC:L), no attack requirements (AT:N), no user interaction (UI:N), and full High impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H). The key limiting signal is PR:L - exploitation requires an authenticated account, so this is not mass, unauthenticated internet exploitation. The notable amplifier is that the description states impact applies 'regardless of role,' meaning any authenticated low-privilege user can fully read, modify, or delete historian data, effectively bypassing the role model (a horizontal/privilege-impact escalation). SC/SI/SA are N, so there is no confirmed scope change to other systems. EXPLICIT DATA GAPS/CONFLICTS: No EPSS score is provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, and no public exploit code is identified; therefore active-exploitation claims cannot be made. The vuln.today Decision label is 'this_week', consistent with a serious, patch-available flaw that warrants prompt but not emergency remediation. Net assessment: a real priority for any JSON-SCADA operator because an ICS historian is a sensitive asset and even low-privilege accounts gain full data control, tempered by the authentication prerequisite and the absence of KEV/EPSS/PoC signals.

An attacker holding any low-privilege authenticated JSON-SCADA account sends a crafted OPC HistoryRead API request to opcApi() with stacked SQL statements embedded in the NodeId.Id, StartTime, or EndTime values. Because these parameters are concatenated into the backend query, the attacker reads, alters, or deletes historian data across all locations irrespective of their assigned role. No public working exploit code is identified, though the vulnerable code region (index.js lines 2175-2224 in V0.64-alpha) is referenced publicly in the VulnCheck advisory.