ScadaLTS EUVD-2026-57417

Exploitation requires that a victim with browser access to ScadaLTS 2.7.8.1 be socially engineered into clicking a crafted URL - user interaction is mandatory and represents the primary limiting factor (UI:R). The attacker requires no authentication and no special account (PR:N), and the attack involves no race conditions or complex timing (AC:L), meaning the only prerequisite beyond crafting the URL is successfully delivering it to a victim. Non-default configuration is not required; the flaw is present in the default web interface. Exploitation is bounded by: (1) the victim must actively click the link in a live browser session to ScadaLTS, and (2) the attacker's ability to reach the victim via phishing or a shared page - direct unauthenticated exploitation without victim interaction is not possible for this reflected XSS class.

The provided CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N yields a score of 6.1, which accurately reflects the medium severity: the attack is network-delivered with no required privileges and low complexity, but mandatory user interaction (UI:R) gates exploitation. No EPSS score is provided in the input data, so probabilistic exploitation rate cannot be independently assessed. There is no CISA KEV listing and no confirmed public exploit code, indicating this is not under known active widespread exploitation at time of analysis. Despite the moderate CVSS, the SCADA operational context significantly elevates real-world risk: victims are engineers or operators whose browser sessions carry authority over industrial control actions, meaning even limited script-accessible confidentiality and integrity impact (C:L/I:L) can translate to operational consequences disproportionate to the base score. The wildcard CPE version range suggests NVD has not bounded affected versions beyond 2.7.8.1, so broader version exposure is possible but unconfirmed.

An attacker discovers a ScadaLTS 2.7.8.1 instance reachable by operational staff, crafts a URL embedding a JavaScript payload in a reflected request parameter, and delivers it to a SCADA operator via phishing email. When the operator clicks the link in a browser where they are authenticated to ScadaLTS, the application reflects the payload into the HTML response and the script executes under the ScadaLTS origin, allowing the attacker to exfiltrate the operator's session cookie or silently submit commands through the interface.