Executive brief
ScadaLTS is an open-source web-based SCADA/HMI application used to monitor and control industrial systems. An authenticated attacker with low privilege credentials can bypass security controls in the JavaScript scripting sandbox to execute arbitrary code on the server with root-level privileges. This allows complete compromise of the industrial control system, including data manipulation, system shutdown, and lateral movement to connected equipment.
Technical details
The vulnerability exists in the DWR (Direct Web Remoting) "DataSourceEditDwr" class, which exposes a "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. Although the vendor implemented a regex validator (ScriptValidatorUtils) and expanded the ClassShutter denylist to block dangerous classes like java.lang.ProcessBuilder, this defense is trivially bypassed by instantiating an unrestricted JavaScript engine via javax.script.ScriptEngineManager (not in the denylist) and encoding the payload as integer character codes to evade regex detection. The new engine lacks the restrictive ClassShutter, enabling direct access to java.lang.ProcessBuilder for code execution. Authentication is required, but the DWR authorization bypass (CVE-2026-84860) allows any authenticated user to invoke restricted methods regardless of URL-based access controls due to disabled crossDomainSessionSecurity. A single HTTP request from a low-privilege user achieves remote code execution with output exfiltration.
Affected products
- ScadaLTS ScadaLTS 2.8.1-release-candidate build 0
Timeline
- 2026-09-16: disclosed