PT-2025-34136 · Scada-Lts · Scada-Lts

Marceloqz · Published 2025-08-20 · Updated 2025-08-21 · CVE-2025-9234

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Scada-LTS versions prior to 2.7.8.2

Description: A vulnerability exists in Scada-LTS that allows for cross-site scripting (XSS). The issue is related to the manipulation of the Alias argument within an unknown function of the maintenance events.shtm file. This attack can be executed remotely. The exploit is publicly available.

Recommendations: Update Scada-LTS to version 2.7.8.2 or later. As a temporary workaround, sanitize the Alias argument to prevent the injection of malicious scripts. Restrict access to the maintenance events.shtm file to minimize the risk of exploitation.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

BDU:2025-14903

CVE-2025-9234

Affected Products

Scada-Lts

References · 10

• 🔥 https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20maintenance_events.shtm%20parameter%20Alias.md#poc · Exploit
• 🔥 https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9234.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9234 · Security Note
• https://bdu.fstec.ru/vul/2025-14903 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9234 · Vendor Advisory
• https://vuldb.com/?submit.631119 · Note
• https://vuldb.com/?id.320767 · Note
• https://vuldb.com/?ctiid.320767 · Note
• https://t.me/CVEtracker/30507 · Telegram Post
• https://twitter.com/CVEnew/status/1958397809473753122 · Twitter Post