Patch Status: No official patch available; the project is unmaintained
Vulnerability Summary
The vulnerability allows a logged-in user to submit and execute JavaScript through exposed server-side scripting functionality.
Because the submitted scripts can execute with root-level operating-system privileges and the input is not adequately neutralized, a low-privileged authenticated user may achieve complete compromise of the ScadaBR host.
Attack Flow
The analysis describes the following attack path:
Authenticate — Obtain or use a valid ScadaBR account.
Reach the scripting API — Access the exposed server-side scripting functionality.
Inject OS commands — Malicious input reaches an OS-level execution path.
Execute as root — The submitted JavaScript runs with full OS privileges.
Full compromise — The attacker can gain root-level control of the affected SCADA host.
CVSS & Security Impact
The vulnerability has a CVSS v3.1 base score of 9.9 (Critical).
CVSS Characteristics
Metric
Value
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Potential Impact
Confidentiality: Unauthorized access to OT/SCADA configuration and data.
Integrity: Ability to alter control logic and process data.
Availability: Root-level access may allow disruption or shutdown of monitored systems.
Affected Environments
ScadaBR may be deployed in environments such as:
Water and wastewater treatment
Energy and power infrastructure
Manufacturing and industrial automation
Building automation
The actual exposure depends on how a specific deployment is configured, segmented, and connected.
Mitigation & Defensive Recommendations
Because no official patch is available, the briefing recommends defensive measures including:
Isolate ScadaBR within a segmented OT network.
Block unnecessary internet exposure.
Restrict web-interface access through a VPN or jump host.
Disable or remove the scripting feature if it is not required.
Enforce least-privilege accounts.
Rotate credentials where appropriate.
Plan migration to Scada-LTS, the maintained successor project.
Responsible Research
This repository is intended for authorized security research, vulnerability analysis, defensive security, and educational purposes.
Proof-of-concept and exploit code are intentionally not included. The accompanying briefing focuses on understanding the vulnerability, attack conditions, impact, and defensive mitigation.
0xmhany/cve-2026-9645-scadabr-analysis
