CVE-2025-13790
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was determined in Scada-LTS up to 2.7.8.1. An unknown function is vulnerable to Cross-Site Request Forgery (CSRF). The attack may be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
The CSRF vulnerability could allow an attacker to perform unauthorized actions on behalf of a logged-in user, potentially leading to data integrity issues or system takeover.
Recommendation
It is recommended to upgrade to a version that fixes this vulnerability and implement CSRF protection mechanisms such as anti-CSRF tokens.
Other vulnerabilities in Scada-LTS
See all- CVE-2025-13791Medium
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-10235Low
A cross-site scripting (XSS) vulnerability was found in Scada-LTS up to version 2.7.8.1 in the /reports.shtm file of the Reports Module component. Manipulating the Colour argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
- CVE-2025-10234Low
A cross-site scripting (XSS) vulnerability was detected in Scada-LTS up to version 2.7.8.1 in the /data_point_edit.shtm file of the Data Point Edit Module component. Manipulating the Text Renderer properties leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Original NVD description (English source)
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS