PT-2026-21799 · Insat · Insat Masterscada Buk-Ts

Adem El Adeb · Published 2025-11-09 · Updated 2026-02-27 · CVE-2026-21410

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InSAT MasterSCADA BUK-TS (affected versions not specified)

Description InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Successful exploitation allows malicious users to potentially cause remote code execution. The issue does not require any privileges or user interaction and has a high impact on confidentiality, integrity, and availability. The vulnerable endpoint allows for this exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-13914

CVE-2026-21410

Affected Products

Insat Masterscada Buk-Ts

References · 11

• https://bdu.fstec.ru/vul/2025-13914 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21410 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-01.json · Note
• https://bukts.ru · Note
• https://t.me/CVEtracker/45657 · Telegram Post
• https://t.me/cveNotify/153405 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026471266933195167 · Twitter Post
• https://twitter.com/CveTodo/status/2026408868792717485 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-055-01 · Note
• https://twitter.com/CVEnew/status/2026676423809970569 · Twitter Post
• https://twitter.com/kernyx64/status/2026545247073771540 · Twitter Post