CVE-2025-13790
📋 TL;DR
This vulnerability allows attackers to perform Cross-Site Request Forgery (CSRF) attacks against Scada-LTS systems. Attackers can trick authenticated users into executing unwanted actions on the SCADA system. This affects all Scada-LTS installations up to version 2.7.8.1.
💻 Affected Systems
- Scada-LTS
📦 What is this software?
Scada Lts by Scada Lts
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify SCADA configurations, manipulate industrial processes, or disrupt critical infrastructure operations through unauthorized actions performed by authenticated users.
Likely Case
Attackers could change system settings, create/modify user accounts, or alter data point configurations without the user's knowledge.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to unauthorized configuration changes that can be detected and rolled back.
🎯 Exploit Status
Exploit requires the victim to be authenticated and visit a malicious page. The PoC is publicly available in GitHub repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to any version above 2.7.8.1 if available, or implement workarounds.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection tokens to all state-changing endpoints in Scada-LTS
Manual code modification required - add anti-CSRF tokens to forms and validate them server-side
SameSite Cookie Attribute
allSet SameSite=Strict or SameSite=Lax attributes on session cookies
Set-Cookie: session=value; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement network segmentation to isolate SCADA systems from untrusted networks
- Use web application firewalls (WAF) with CSRF protection rules enabled
🔍 How to Verify
Check if Vulnerable:
Check Scada-LTS version. If version is 2.7.8.1 or lower, system is vulnerable.Check Version:
Check Scada-LTS web interface or configuration files for version informationVerify Fix Applied:
Test CSRF protection by attempting to submit requests without valid CSRF tokens. Requests should be rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed state-changing requests from same IP
- Configuration changes without corresponding user actions in audit logs
Network Indicators:
- HTTP POST requests to Scada-LTS endpoints without Referer headers or with external Referers
- Requests with missing or invalid anti-CSRF tokens
SIEM Query:
source="scada-lts" AND (action="modify" OR action="create" OR action="delete") AND referer NOT CONTAINS "your-domain.com"