CVE-2025-13791
📋 TL;DR
This vulnerability allows remote attackers to perform path traversal attacks via the project import function in Scada-LTS. By exploiting improper path validation in ZIP file extraction, attackers can write arbitrary files outside the intended directory. This affects all Scada-LTS installations up to version 2.7.8.1.
💻 Affected Systems
- Scada-LTS
📦 What is this software?
Scada Lts by Scada Lts
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or disruption of industrial control operations
Likely Case
Arbitrary file write allowing file system manipulation, potential privilege escalation, or denial of service
If Mitigated
Limited impact if proper file system permissions restrict write access to critical directories
🎯 Exploit Status
Proof-of-concept exploit is publicly available in GitHub repository
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to any future version that addresses this issue.
🔧 Temporary Workarounds
Disable Project Import Feature
allRemove or disable the project import functionality to prevent exploitation
# Remove or rename the ZIPProjectManager.java file
# Disable web access to project import endpoints
Implement Input Validation
allAdd path traversal validation to the Common.getHomeDir function
# Modify br/org/scadabr/vo/exporter/ZIPProjectManager.java
# Add path normalization and validation before file operations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Scada-LTS from untrusted networks
- Deploy web application firewall with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check if Scada-LTS version is 2.7.8.1 or earlier and if project import feature is enabledCheck Version:
# Check Scada-LTS version in web interface or configuration filesVerify Fix Applied:
Verify that path traversal attempts are properly blocked during project import operations📡 Detection & Monitoring
Log Indicators:
- Multiple failed project import attempts
- Unusual file write operations outside expected directories
- Path traversal patterns in request logs
Network Indicators:
- Unusual ZIP file uploads to project import endpoints
- Requests containing '../' patterns
SIEM Query:
source="scada-lts" AND (event="project_import" OR url="*import*") AND (message="*../*" OR message="*..\\*")