CVE-2026-115803 in Scada-LTS
Summary
by MITRE • 10/24/2026
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/24/2026
The vulnerability identified in Scada-LTS version 2.8.0 represents a critical authorization bypass flaw located within the AmCharts Data API component, specifically affecting the HttpServletRequest.getParameter function implemented in the AmChartValuesAPI.java file. This security defect arises from insufficient validation or sanitization of user-supplied input parameters, particularly those associated with the ids argument. In typical web application architectures, this parameter is often used to identify specific data points or chart elements for retrieval or manipulation. However, due to the flawed implementation in Scada-LTS 2.8.0, an attacker can manipulate these identifiers to bypass intended access controls. This allows unauthorized entities to interact with sensitive system functions or retrieve restricted information that should only be accessible to authenticated and authorized users. The nature of this flaw aligns closely with CWE-287, which describes Improper Authentication, as the application fails to correctly verify the identity of a user before granting access to protected resources.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the attack vector involves manipulating HTTP request parameters over a network connection, an attacker does not need physical or local system access to compromise the integrity and confidentiality of the SCADA environment. The fact that public exploits have been published significantly elevates the risk profile, as it lowers the barrier for entry for malicious actors who may lack sophisticated development skills but can leverage existing tooling to target vulnerable instances. In a Supervisory Control and Data Acquisition context, such an authorization bypass could lead to unauthorized monitoring of critical infrastructure processes, manipulation of control parameters, or extraction of sensitive operational data. This compromises not only the confidentiality of information but potentially the availability and integrity of industrial operations if the manipulated inputs trigger unintended system behaviors.
From a threat intelligence perspective, this vulnerability maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts, as it involves using legitimate credentials or bypassing authentication mechanisms entirely to gain unauthorized access. It also relates to CWE-20, Improper Input Validation, because the root cause lies in the failure to properly validate and sanitize input data before processing. The persistence of this flaw in version 2.8.0 highlights a gap in secure coding practices regarding API endpoint security. Attackers can craft specific HTTP requests that exploit the parameter manipulation logic, effectively tricking the server into treating an unauthenticated or lower-privileged request as if it originated from a high-privilege user session. This undermines the fundamental principle of least privilege within the application architecture.
To mitigate this risk, immediate action is required by system administrators and security teams managing Scada-LTS deployments. The vendor has acknowledged the issue and announced that they are working on a new release with specific security enhancements to address these flaws. Organizations should prioritize upgrading to the patched version as soon as it becomes available. In the interim, while awaiting the official patch, defensive measures can be implemented at the network perimeter or application layer. Web Application Firewalls (WAFs) can be configured with rulesets designed to detect and block anomalous patterns in HTTP request parameters that resemble known exploitation attempts for authorization bypasses. Additionally, implementing strict input validation on the server side before any processing occurs is crucial. This includes enforcing type checking, length limits, and allowing only expected character sets for the ids parameter. Network segmentation should also be reviewed to ensure that the SCADA network is isolated from untrusted networks, limiting the attack surface available to remote adversaries. Regular security audits and penetration testing of API endpoints are recommended to identify similar vulnerabilities in other components before they can be exploited.