A critical SQL injection vulnerability in Weidmueller Interface PROCON-WEB SCADA allows remote, unauthenticated attackers to execute arbitrary database commands, posing a severe risk of data compromise.

The application fails to properly sanitize input within the GetGridData endpoint. This allows an unauthenticated remote attacker to perform SQL injection attacks against the underlying database.

Successful exploitation of this flaw grants an attacker the ability to read, modify, or delete sensitive data within the SCADA environment. Given the CVSS score of 9.8, this vulnerability represents a critical risk to operational integrity and data confidentiality, potentially leading to unauthorized control over industrial processes or complete system compromise.

Immediate Action: Update to the latest version of PROCON-WEB SCADA provided by Weidmueller Interface as soon as it becomes available.

Proactive Monitoring: Review database and application access logs for unusual query patterns or unexpected data modification events originating from the GetGridData endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at web-based SCADA interfaces.

Public Exploit Available: No

This vulnerability is highly critical due to the ease of access for an unauthenticated attacker and the potential for total system compromise. Administrators must prioritize applying security updates provided by the vendor immediately upon release to prevent unauthorized database access.