ScadaLTS Multiple Vulnerabilities

ScadaLTS is an open-source, web-based SCADA/HMI application. Version 2.8.1-release-candidate build 0 is affected by multiple vulnerabilities:

CVE-2026-84858: Authenticated Remote Code Execution via Scripting Sandbox Bypass (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass (see below).

The vendor added a source-level regex validator (ScriptValidatorUtils) and expanded the ClassShutter denylist in this build to block classes such as java.lang.ProcessBuilder. However, this defense is trivially bypassed by spawning a new unrestricted JavaScript engine via javax.script.ScriptEngineManager (which is not in the denylist) and encoding the inner payload as integer character codes to evade the source-level regex check. The new engine does not inherit the Rhino ClassShutter, giving full unrestricted access to java.lang.ProcessBuilder.

This results in a single HTTP request from a low-privilege user achieving root-level remote code execution with inline output exfiltration.

CVE-2026-84859 : Authenticated Blind SQL Injection (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users.

The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.

This vulnerability can allow malicious users to extract data from the database.

Prerequisite: The attacking user must have at least one visible event in the userEvents table. This is the normal operational state for any SCADA operator who has data-point or data-source event subscriptions configured.

CVE-2026-84860 DWR Authorization Bypass - Systemic (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body.

This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.