CVE-2026-19656
CriticalCVSS 9.9Summary
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
Risk Assessment
The risk for the organization is full system compromise, as an attacker can gain complete control over the server and industrial data.
Recommendation
It is recommended to immediately apply patches provided by the ScadaLTS vendor and restrict system access to trusted users only. Also monitor logs for unusual commands.
Original NVD description (English source)
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.