Scada-LTS vulnerabilities
We track 5 vulnerabilities in Scada-LTS products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest Scada-LTS vulnerabilities
- 8.8 High severity
Scada-LTS: Authorization Bypass Through User-Controlled Key
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSe
- 8.8 High severity
Scada-LTS: Improper Control of Generation of Code
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rh
- 9.9 Critical severity
ScadaLTS: Missing Authorization
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation
- 8.8 High severity
Scada-LTS: Cross-Site Request Forgery
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was
- 8.8 High severity
scada-lts: Improper Control of Generation of Code
An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code, and obtain sensitive information via Event Handlers function.