Quick answers
- Is CVE-2025-13790 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-13790 being exploited in the wild.
- How severe is CVE-2025-13790?
- Medium severity, with a CVSS score of 4.3, published 30 November 2025.
- Which products and versions are affected?
- Scada-Lts up to 2.7.8.1.
- Is there a fix for CVE-2025-13790?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-13790 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2025-13790?
- Check whether you run Scada-Lts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Scada-LTS disables Spring Security's CSRF protection across all HTTP contexts by setting `<csrf disabled="true"/>` in spring-security.xml. Authenticated endpoints such as /api/watch-lists and /api/reports/save accept POST/PUT/DELETE requests with no CSRF token validation, relying solely on session cookies (JSESSIONID) for authentication. An attacker can craft a malicious webpage that submits hidden forms to these endpoints; when a logged-in victim visits the page, their browser automatically includes their session cookie, executing the unauthorized request. No alternative CSRF mitigations (double-submit tokens, SameSite enforcement, per-request nonces) are present in the codebase. The vulnerability affects all versions up to and including the develop branch commit 1cfaed4b35117e4871bc3dfeae073f61d8e3bb3d, and the vendor has not yet released a patch.
Affected products
- SCADA-LTS Scada-LTS up to 2.7.8.1
Timeline
- 2025-11-30: disclosed
- other: publicly available exploit published on GitHub