A vulnerability, which was classified as problematic, has been found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting.
This vulnerability is reported as CVE-2025-9138. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor explains: “[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities – the overall risk change to the user due to malicious admin actions will not be lower. An admin user – by definition – has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words – due to the design of the system it is not possible to limit the admin user to attack the users.”
