A critical remote code execution vulnerability in Scada-LTS 2.8.1 enables authenticated attackers to execute arbitrary JavaScript and gain unauthorized system control.

The vulnerability exists within the DataSourceEditDwr class, where the validateScript method fails to perform adequate authorization checks before compiling and executing user-supplied JavaScript via the Rhino engine. This allows an authenticated user to achieve remote code execution by leveraging a DWR routing bypass.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary code on the underlying server, leading to a total compromise of the application and potentially the host environment. Given the CVSS score of 8.8, this vulnerability poses a severe risk of data exfiltration, service disruption, and lateral movement within the industrial control or monitoring network.

Immediate Action: Restrict access to the Scada-LTS interface to authorized personnel only, and monitor for official vendor security updates or patches to address the DataSourceEditDwr flaw.

Proactive Monitoring: Review application access logs for unusual DWR routing requests and monitor for suspicious child processes initiated by the Java runtime environment.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests targeting the DataSourceEditDwr endpoint, effectively neutralizing attempts to trigger the vulnerable validation method.

Public Exploit Available: Unknown.

The high severity of this vulnerability necessitates immediate attention, particularly for systems exposed to untrusted networks. While a formal patch is currently unavailable, organizations should prioritize isolating the affected application and implementing strict access controls to prevent low privilege users from reaching the vulnerable endpoint.