CVE-2026-84859
MediumCVSS 6.5Summary
An authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0 in the /api/events/search endpoint. The sortBy array values are concatenated directly into the SQL ORDER BY clause without sanitization, allowing authenticated users with ROLE_USER to perform time-based and boolean-based blind SQL injection to extract arbitrary data, including password hashes of all users.
Risk Assessment
The risk involves the theft of authentication data and other sensitive information, which could lead to full compromise of the SCADA system.
Recommendation
Immediately apply vendor patches or restrict access to this endpoint, and use parameterized SQL queries and input validation.
Other vulnerabilities in ScadaLTS
See all- CVE-2026-84860High
ScadaLTS 2.8.1-release-candidate build 0 suffers from an authorization bypass in DWR endpoints. Spring Security gates by URL pattern, but DWR dispatches based on POST body parameters, allowing any authenticated user to invoke any DWR method.
- CVE-2026-84858High
ScadaLTS 2.8.1-release-candidate build 0 has a remote code execution (RCE) vulnerability via scripting sandbox bypass. The validateScript method in DataSourceEditDwr compiles and executes attacker-supplied JavaScript without authorization, which can be exploited by a low-privileged user.
- CVE-2026-19656Critical
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
- CVE-2026-19657Medium
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
Original NVD description (English source)
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users. The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.