Skip to content
OpenAdvisories
Critical ICSA-26-139-03 4 CVEs

ScadaBR

Published May 19, 2026 · Updated May 19, 2026

Vendor: ScadaBR Product: ScadaBR

Summary

Successful exploitation of these vulnerabilities could allow an attacker to perform unauthenticated remote code execution.

Vulnerabilities 4

  • High 8.8
    CVE-2026-8602

    Missing authentication for critical function in ScadaBR

    In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.

    ScadaBR ScadaBR
  • High 8.7
    CVE-2026-8603

    Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR

    In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

    ScadaBR ScadaBR
  • High 8.6
    CVE-2026-8604

    Cross-Site request forgery (CSRF) in ScadaBR

    In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.

    ScadaBR ScadaBR
  • Medium 5.1
    CVE-2026-8605

    Use of Hard-coded Credentials in ScadaBR

    In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.

    ScadaBR ScadaBR

Revision history

  1. #1

    Initial Publication

References