CVE-2026-8602
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
ScadaBR version 1.2.0 has a missing authentication for critical function vulnerability, allowing an unauthenticated attacker to send HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
Risk Assessment
An attacker can manipulate sensor data, potentially causing false alarms, incorrect operational decisions, or hiding real threats in the industrial system.
Recommendation
Implement authentication mechanisms for critical functions in ScadaBR or consider migrating to a newer, secure version of the system.
Other vulnerabilities in ScadaBR
See all- CVE-2026-8605Critical
In ScadaBR version 1.2.0, use of hard-coded credentials allows an attacker to access the SCADA system as admin.
- CVE-2026-8603Critical
ScadaBR version 1.2.0 contains an OS command injection vulnerability. An attacker can execute arbitrary commands as root on the SCADA system.
- CVE-2026-94148Medium
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be utilized.
- CVE-2026-8604High
A CSRF vulnerability in ScadaBR version 1.2.0 allows an attacker to lure a logged-in user to a malicious webpage, triggering any authenticated action in the victim's session.
Original NVD description (English source)
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS