PT-2025-33728 · Scada-Lts · Scada-Lts

Natan Morette + 1 · Published 2025-07-23 · Updated 2025-08-22 · CVE-2025-9139

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Scada-LTS version 2.7.8.1

Description: A vulnerability exists in Scada-LTS 2.7.8.1 within an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Manipulation of this functionality can lead to information disclosure. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The vendor states that the risks associated with this vulnerability appear minimal, as exploitation likely requires administrator permissions, and fixing the vulnerability will not reduce the overall risk from malicious administrator actions.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

BDU:2025-10888

CVE-2025-9139

Affected Products

Scada-Lts

References · 11

• 🔥 https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Sensitive%20User%20Information%20Disclosure%20via%20WatchListDwr.init.dwr%20Endpoint.md#proof-of-concept-poc · Exploit
• 🔥 https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/%20CVE-2025-9139.md · Exploit
• 🔥 https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Sensitive%20User%20Information%20Disclosure%20via%20WatchListDwr.init.dwr%20Endpoint.md · Exploit
• 🔥 https://vuldb.com/?submit.621062 · Exploit
• https://bdu.fstec.ru/vul/2025-10888 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-9139 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9139 · Vendor Advisory
• https://vuldb.com/?ctiid.320519 · Note
• https://vuldb.com/?id.320519 · Note
• https://t.me/cveNotify/133247 · Telegram Post
• https://t.me/CVEtracker/30350 · Telegram Post