Scadabr
Monthly
Remote code execution in ScadaBR allows authenticated users to abuse exposed server-side methods to create and execute arbitrary JavaScript that runs as root, resulting in full host compromise. The CVSS 9.9 rating reflects scope change and complete confidentiality, integrity, and availability impact, and no public exploit is identified at time of analysis despite the issue being formally reported by Tenable Research (TRA-2026-46).
Cross-site request forgery in ScadaBR 1.2.0 lets a remote attacker execute any authenticated action by luring a logged-in operator to a malicious web page, which silently submits forged requests under the victim's session. Because ScadaBR is a SCADA/HMI platform, forged actions can alter data points, configuration, and control logic, giving state-changing impact on industrial processes. No public exploit has been identified at time of analysis and the EPSS score is very low (0.02%), but CISA ICS-CERT triaged it as high severity (CVSS 4.0 8.6) with 'total' technical impact.
OS command injection in ScadaBR 1.2.0 lets an authenticated attacker execute arbitrary operating-system commands as root on the underlying SCADA host. Reported through CISA's ICS-CERT (ICSA-26-139-03) and rated CVSS 4.0 8.7, the flaw hands an attacker with low-level application access full control of the industrial control server. There is no public exploit identified at time of analysis, and EPSS is low (0.59%), consistent with CISA's SSVC assessment of no observed exploitation.
Sensor-data injection in ScadaBR 1.2.0 lets an unauthenticated attacker forge arbitrary sensor readings by sending crafted HTTP GET requests to the SCADA system, because the data-writing function performs no authentication (CWE-306). Reported by ICS-CERT and tracked as ICSA-26-139-03, the flaw carries a CVSS 4.0 base of 8.8 driven by high integrity and availability impact; there is no public exploit identified at time of analysis and EPSS is low (0.08%), but CISA SSVC rates it automatable, meaning attacks could be scripted at scale against exposed instances.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Reflected cross-site scripting in ScadaBR's URL handling allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link targeting the ScadaBR web interface. The vulnerability carries a CVSS 6.1 score with Scope:Changed, meaning injected scripts execute in a security context that can affect resources beyond the originating ScadaBR page - particularly significant given ScadaBR's role as a web-based SCADA platform managing industrial control systems. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the ICS/OT deployment context amplifies the potential operational impact of credential theft or session hijacking.
Hard-coded administrative credentials in ScadaBR 1.2.0 expose SCADA systems to unauthorized admin-level access via the network-accessible web interface. An unauthenticated remote attacker who knows the embedded credentials - discoverable through documentation, advisory disclosure, or reverse engineering - can authenticate directly as administrator without any legitimate credential. Reported by ICS-CERT (ICSA-26-139-03) and catalogued under EUVD-2026-30963, this flaw is rated automatable by SSVC, raising particular concern in operational technology environments where admin access can translate to physical process manipulation.
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. [CVSS 4.8 MEDIUM]
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in ScadaBR allows authenticated users to abuse exposed server-side methods to create and execute arbitrary JavaScript that runs as root, resulting in full host compromise. The CVSS 9.9 rating reflects scope change and complete confidentiality, integrity, and availability impact, and no public exploit is identified at time of analysis despite the issue being formally reported by Tenable Research (TRA-2026-46).
Cross-site request forgery in ScadaBR 1.2.0 lets a remote attacker execute any authenticated action by luring a logged-in operator to a malicious web page, which silently submits forged requests under the victim's session. Because ScadaBR is a SCADA/HMI platform, forged actions can alter data points, configuration, and control logic, giving state-changing impact on industrial processes. No public exploit has been identified at time of analysis and the EPSS score is very low (0.02%), but CISA ICS-CERT triaged it as high severity (CVSS 4.0 8.6) with 'total' technical impact.
OS command injection in ScadaBR 1.2.0 lets an authenticated attacker execute arbitrary operating-system commands as root on the underlying SCADA host. Reported through CISA's ICS-CERT (ICSA-26-139-03) and rated CVSS 4.0 8.7, the flaw hands an attacker with low-level application access full control of the industrial control server. There is no public exploit identified at time of analysis, and EPSS is low (0.59%), consistent with CISA's SSVC assessment of no observed exploitation.
Sensor-data injection in ScadaBR 1.2.0 lets an unauthenticated attacker forge arbitrary sensor readings by sending crafted HTTP GET requests to the SCADA system, because the data-writing function performs no authentication (CWE-306). Reported by ICS-CERT and tracked as ICSA-26-139-03, the flaw carries a CVSS 4.0 base of 8.8 driven by high integrity and availability impact; there is no public exploit identified at time of analysis and EPSS is low (0.08%), but CISA SSVC rates it automatable, meaning attacks could be scripted at scale against exposed instances.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Reflected cross-site scripting in ScadaBR's URL handling allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser session when the victim clicks a crafted link targeting the ScadaBR web interface. The vulnerability carries a CVSS 6.1 score with Scope:Changed, meaning injected scripts execute in a security context that can affect resources beyond the originating ScadaBR page - particularly significant given ScadaBR's role as a web-based SCADA platform managing industrial control systems. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the ICS/OT deployment context amplifies the potential operational impact of credential theft or session hijacking.
Hard-coded administrative credentials in ScadaBR 1.2.0 expose SCADA systems to unauthorized admin-level access via the network-accessible web interface. An unauthenticated remote attacker who knows the embedded credentials - discoverable through documentation, advisory disclosure, or reverse engineering - can authenticate directly as administrator without any legitimate credential. Reported by ICS-CERT (ICSA-26-139-03) and catalogued under EUVD-2026-30963, this flaw is rated automatable by SSVC, raising particular concern in operational technology environments where admin access can translate to physical process manipulation.
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. [CVSS 4.8 MEDIUM]
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.