PT-2025-29895 · Scada-Lts · Scada-Lts

Nmmorette · Published 2025-07-17 · Updated 2025-07-17 · CVE-2025-7728

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Scada-LTS versions prior to 2.8.0

Description A problematic vulnerability exists in Scada-LTS. The issue affects an unknown function within the users.shtm file. Manipulation of the Username argument can lead to cross-site scripting (XSS). The attack can be launched remotely. The exploit has been publicly disclosed and may be used. The vendor has confirmed a fix will be included in the next release.

Recommendations Scada-LTS versions prior to 2.8.0: Upgrade to version 2.8.0 or later to resolve this issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

BDU:2025-15296

CVE-2025-7728

Affected Products

Scada-Lts

References · 14

• 🔥 https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/CVE-2025-7728.md · Exploit
• 🔥 https://github.com/nmmorette/vulnerability-research/blob/main/scada2/README.md · Exploit
• https://bdu.fstec.ru/vul/2025-15296 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7728 · Security Note
• https://github.com/SCADA-LTS/Scada-LTS · Note
• https://t.me/cvetracker/28018 · Telegram Post
• https://vuldb.com/?ctiid.316710 · Note
• https://vuldb.com/?id.316710 · Note
• https://twitter.com/VulmonFeeds/status/1945722411514540119 · Twitter Post
• https://t.me/cvenotify/129260 · Telegram Post
• https://t.me/cvenotify/129262 · Telegram Post
• https://vuldb.com/?submit.607949 · Note
• https://twitter.com/CVEnew/status/1945681881334476806 · Twitter Post