CVE-2026-94148
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely, and the exploit has been publicly disclosed and may be utilized.
Risk Assessment
An attacker can remotely access sensitive information from the ScadaBR project. Data exposure could lead to further attacks or compromise of the system.
Recommendation
Upgrade ScadaBR to version 1.2.0 or later, which includes the patch named c852b4988a15bce6011ef169299ad604538f70a9. Ensure the export endpoint is properly secured.
Other vulnerabilities in ScadaBR
See all- CVE-2026-8605Critical
In ScadaBR version 1.2.0, use of hard-coded credentials allows an attacker to access the SCADA system as admin.
- CVE-2026-8603Critical
ScadaBR version 1.2.0 contains an OS command injection vulnerability. An attacker can execute arbitrary commands as root on the SCADA system.
- CVE-2026-8602Critical
ScadaBR version 1.2.0 has a missing authentication for critical function vulnerability, allowing an unauthenticated attacker to send HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
- CVE-2026-8604High
A CSRF vulnerability in ScadaBR version 1.2.0 allows an attacker to lure a logged-in user to a malicious webpage, triggering any authenticated action in the victim's session.
Original NVD description (English source)
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS