EUVD-2026-80825
GHSA-mrrr-7mg7-864j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable DWR method, low complexity, requires a low-privilege authenticated account (PR:L), and server-side code execution yields full confidentiality, integrity, and availability impact.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
2DescriptionCVE.org
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass
The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.
AnalysisAI
Authenticated remote code execution in ScadaLTS 2.8.1-release-candidate build 0 allows any holder of a low-privilege account to run arbitrary JavaScript on the server by abusing the scripting sandbox. The DWR-exposed DataSourceEditDwr.validateScript method performs no authorization check and is reachable through a DWR routing bypass, so supplied code is compiled and executed by the Rhino engine with the application's privileges (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privilege Scada-LTS user account (per CVSS PR:L and the description's 'access to a low privilege user'), and network reachability to the application's DWR interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, credible priority rather than an inflated high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis, and the provided references point only to research and tracking advisories (https://www.tenable.com/security/research/tra-2026-60 and https://nvd.nist.gov/vuln/detail/CVE-2026-84858) rather than a fixed release; confirm current ScadaLTS release notes before assuming an upgrade resolves the issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ScadaLTS 2.8.1-release-candidate build 0 deployments, confirm whether DWR is exposed, and restrict network access to the application and DWR endpoints; disable or block DataSourceEditDwr.validateScript and the scripting sandbox if business operations permit, and audit low-privilege accounts for necessity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authen
Privileged remote code execution in ScadaLTS 2.7.8.1 lets any authenticated user - including accounts holding only low-p
Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR metho
Authenticated blind SQL injection in ScadaLTS 2.8.1-release-candidate build 0 lets any logged-in user with the lowest pr
Reflected cross-site scripting in ScadaLTS 2.7.8.1 enables an unauthenticated remote attacker to execute arbitrary JavaS
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remot
A vulnerability was determined in Scada-LTS up to 2.7.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remot
A vulnerability was determined in Scada-LTS 2.7.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely ex
Stored cross-site scripting (XSS) in Scada-LTS up to version 2.7.8.1 allows authenticated remote attackers to inject mal
Stored cross-site scripting (XSS) in Scada-LTS up to 2.7.8.1 allows authenticated users to inject malicious scripts via
A vulnerability has been found in Scada-LTS 2.7.8.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely ex
A vulnerability was determined in Scada-LTS up to 2.7.8.1. Rated medium severity (CVSS 5.1), this vulnerability is remot
Share
External POC / Exploit Code
Leaving vuln.today