A critical authorization bypass vulnerability in Scada-LTS 2.8.1 allows authenticated users to execute unauthorized commands, potentially leading to full system compromise.

The application fails to properly enforce access controls because the Direct Web Remoting (DWR) framework dispatches methods based on POST body parameters rather than URL patterns. Any authenticated user can bypass intended security restrictions by targeting restricted classes through permissible DWR endpoints.

Successful exploitation allows a low-privileged authenticated user to perform unauthorized actions, including the potential for remote code execution or data manipulation within the SCADA environment. Given the CVSS score of 8.8, this flaw presents a high risk to operational integrity and system security. Such access could lead to significant operational disruption or the compromise of sensitive industrial control data.

Immediate Action: Contact the vendor immediately to obtain the latest security patches or configuration guidance to disable vulnerable DWR functionality.

Proactive Monitoring: Review web access logs for unusual POST requests targeting DWR-related endpoints or unexpected method calls originating from low-privilege user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block anomalous POST body parameters that attempt to invoke restricted DWR classes.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a significant security oversight in the request handling architecture of Scada-LTS. Organizations currently running version 2.8.1 should prioritize restricting access to the application and monitor for vendor-provided updates. Immediate patching is necessary to prevent authenticated users from escalating privileges and compromising the integrity of the SCADA infrastructure.