CVE-2026-94148 in ScadaBR
Summary
by MITRE • 09/21/2026
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in ScadaBR versions up to 1.1 represents a critical access control failure within the Export Project Endpoint, specifically affecting the EmportDwr.createExportJSON function located in the /ScadaBR/export_project.htm file. This flaw stems from an inconsistent implementation of security controls where import operations were properly gated with Permissions.ensureAdmin() checks, but export functionality was inadvertently left unprotected. As a result, any authenticated user, regardless of their privilege level or administrative status, can invoke this endpoint to retrieve sensitive project data without authorization. The absence of proper role-based access control for the export mechanism allows attackers to bypass intended security boundaries and extract configuration details, network topology information, and potentially credential-related metadata embedded within SCADA system projects.
From a technical perspective, this vulnerability is classified as an improper privilege escalation or broken access control issue, aligning with CWE-269 (Improper Privilege Assignment) and CWE-862 (Missing Authorization). The attack vector is remote, meaning that an adversary does not need physical proximity to the target system. Instead, they can exploit this flaw over a network connection by sending crafted requests to the vulnerable endpoint. Since the vulnerability has been publicly disclosed and exploits are available in the wild, automated scanning tools or malicious actors actively leveraging known vulnerabilities pose a significant threat landscape for organizations still running affected versions of ScadaBR.
The operational impact of this information disclosure is severe within industrial control systems environments. SCADA systems often manage critical infrastructure such as water treatment plants, power grids, and manufacturing processes. The exposure of project files can reveal network architecture, IP addresses of PLCs (Programmable Logic Controllers), communication protocols in use, and potentially hardcoded credentials or security configurations. This intelligence enables attackers to perform more targeted attacks, including lateral movement within the OT network, preparation for further exploitation via other vulnerabilities, or even sabotage if combined with additional attack vectors. The disclosure undermines the confidentiality integrity required for secure industrial operations.
Mitigation strategies must prioritize immediate remediation through software updates. Upgrading ScadaBR to version 1.2.0 is strongly recommended as it addresses this specific access control gap by ensuring that export functions are subject to the same administrative permission checks as import functions. The patch associated with commit c852b4988a15bce6011ef169299ad604538f70a9 resolves the issue by enforcing consistent authorization logic across all project management endpoints. In environments where immediate upgrading is not feasible, temporary mitigations should include restricting network access to the ScadaBR interface to trusted administrative subnets only, implementing web application firewall rules that block unauthorized requests to the export_project.htm endpoint, and auditing user accounts to ensure minimal privilege principles are enforced for non-administrative users until the patch can be applied.