A vulnerability classified as problematic was found in Scada-LTS 2.7.8.1. This impacts an unknown function of the file scheduled_events.shtm. Such manipulation of the argument alias leads to cross site scripting.
This vulnerability is documented as CVE-2025-9137. The attack can be executed remotely. Additionally, an exploit exists.
The vendor explains: “[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities – the overall risk change to the user due to malicious admin actions will not be lower. An admin user – by definition – has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words – due to the design of the system it is not possible to limit the admin user to attack the users.”
