Description

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-12T20:17:43.060Z",
  "pubdate": "2026-08-12T20:17:43.060Z",
  "executiveSummary": "ScadaLTS version 2.7.8.1 is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper handling of user-supplied input.\nThe flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript code within the context of a victim's browser session by tricking them into interacting with a specially crafted URL.\nThe impacted system is ScadaLTS 2.7.8.1, specifically its web application interface which reflects malicious payloads directly into HTML responses without performing adequate sanitization or output encoding.\nSuccessful exploitation poses significant risk implications, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the authenticated user, and further compromise of the web application interface.\nThe attack requires no prior authentication or elevated privileges within the application, but it does rely on social engineering to successfully lure the victim into visiting the malicious URL.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input sanitization and output encoding within ScadaLTS 2.7.8.1.\nWhen the web application processes user-supplied parameters, it improperly reflects the raw input directly into the resulting HTML response sent back to the browser.\nThe vulnerable component is the web interface handling mechanism that processes unvalidated HTTP request parameters.\nThe affected software version is strictly ScadaLTS 2.7.8.1.\nAuthentication and privilege requirements are minimal, as the attack can be executed by an unauthenticated attacker over the network.\nThe exploitation method involves crafting a malicious URL containing JavaScript payloads injected into the vulnerable parameter.\nThe attack flow proceeds as follows: First, the attacker constructs a URL embedding the arbitrary JavaScript payload within the parameter that is subsequently reflected by the application. Second, the attacker uses social engineering techniques, such as phishing or malicious links, to lure an authenticated victim into clicking and visiting the crafted URL. Third, the victim's browser sends the HTTP request to the ScadaLTS 2.7.8.1 server. Fourth, the server processes the request and returns an HTTP response containing the unsanitized payload reflected directly in the HTML markup. Finally, the victim's browser parses the response and executes the injected JavaScript within the context of the user's active session.\nThe payload behavior involves executing arbitrary script code in the victim's browser session, allowing the attacker to interact with the application using the victim's permissions, access sensitive data, or perform unauthorized administrative or operational actions depending on the victim's privilege level."
}