Executive brief
ScadaLTS is an open-source SCADA/HMI application used to monitor and control industrial systems. The application's web framework incorrectly handles authorization checks, allowing authenticated users to bypass access controls and invoke restricted system functions. This enables attackers to escalate privileges and execute arbitrary operations, potentially compromising critical infrastructure operations and data.
Technical details
ScadaLTS uses Spring Security to gate DWR (Direct Web Remoting) endpoints by URL path pattern, but DWR dispatches method calls based on POST body parameters (c0-scriptName and c0-methodName) instead of the URL. The crossDomainSessionSecurity setting in web.xml is disabled, removing DWR's built-in origin validation. Any authenticated user can invoke any DWR method by sending requests to a URL they have permission to access while specifying a restricted class in the POST body parameters. This systemic bypass enables low-privilege users to exploit other vulnerabilities (such as arbitrary code execution and SQL injection) that would otherwise require elevated privileges. No patch information is currently available as of the advisory publication date.
Affected products
- ScadaLTS ScadaLTS 2.8.1-release-candidate build 0
Timeline
- 2026-09-16: disclosed