CVE-2026-8604
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A CSRF vulnerability in ScadaBR version 1.2.0 allows an attacker to lure a logged-in user to a malicious webpage, triggering any authenticated action in the victim's session.
Risk Assessment
An attacker could alter SCADA system configuration, add users, or perform other unauthorized actions, potentially disrupting industrial processes.
Recommendation
Update ScadaBR to the latest version or implement CSRF protection mechanisms such as anti-CSRF tokens.
Other vulnerabilities in ScadaBR
See all- CVE-2026-8605Critical
In ScadaBR version 1.2.0, use of hard-coded credentials allows an attacker to access the SCADA system as admin.
- CVE-2026-8603Critical
ScadaBR version 1.2.0 contains an OS command injection vulnerability. An attacker can execute arbitrary commands as root on the SCADA system.
- CVE-2026-8602Critical
ScadaBR version 1.2.0 has a missing authentication for critical function vulnerability, allowing an unauthenticated attacker to send HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
Original NVD description (English source)
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.