Scada-LTS EUVD-2026-109243

Requires a valid authenticated low-privileged account on the Scada-LTS 2.8.0 web application (PR:L) and network reachability to the AmCharts Data API endpoint; the attacker then manipulates the 'ids' argument processed by HttpServletRequest.getParameter in AmChartValuesAPI.java to reference identifiers outside their authorization scope. Limiting factors: exploitation is not possible fully unauthenticated (an account/session is needed), no user interaction is required of a victim, and impact is confined to unauthorized reading of data (confidentiality, low) with no integrity or availability consequences. The source evidence does not describe any non-default configuration prerequisite, so the flaw appears to affect the standard deployment of this version.

All signals point to this being a low-priority issue rather than an urgent one. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) yields a base score of 2.1, driven by the fact that only confidentiality is affected and only at a low level (VC:L), with no integrity or availability impact. The vector is network-reachable with low attack complexity and no user interaction, but it requires an authenticated low-privileged account (PR:L), which meaningfully limits exposure. SSVC/temporal signal E:P indicates a Proof-of-Concept maturity, consistent with the description's statement that 'the exploit has been published,' but this is PoC-grade evidence, not confirmed active exploitation. The vuln.today decision label is 'monitor' - the lowest actionable tier - and the CVE is NOT listed in CISA KEV. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CWE-639 classification (authorization bypass through a user-controlled key, i.e. an IDOR on the 'ids' argument) matches the described behavior. Net assessment: a genuine but low-severity authorization/IDOR flaw whose real-world risk is bounded by the authentication requirement, the confidentiality-only impact, and the niche deployment base of Scada-LTS; it warrants patching on a normal cycle rather than emergency action.

An attacker holding a valid low-privileged Scada-LTS account sends a crafted request to the AmCharts Data API, tampering with the 'ids' parameter handled by HttpServletRequest.getParameter in AmChartValuesAPI.java to reference data series they are not authorized to view. Because the endpoint does not properly check the caller's authorization against the requested identifiers, it returns time-series/chart data belonging to other users or resources. A public exploit has reportedly been published per VulDB, and the low attack complexity (AC:L, no user interaction) makes the request trivial to reproduce once authenticated.