Description
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
Published: 2026-10-24
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Authorization bypass via manipulation of request parameters
Action: Immediate patch
AI Analysis

Impact

A flaw in Scada‑LTS 2.8.0 allows an attacker to manipulate the "ids" parameter passed to the AmChartValuesAPI servlet. Because the servlet does not properly enforce authorization, this can result in an authorization bypass that lets the attacker read or modify data not intended for them. The vulnerability is delivered over HTTP and an exploit code has been published.

Affected Systems

The affected product is Scada‑LTS, specifically version 2.8.0. The vulnerability resides in the AmCharts Data API component, in the file AmChartValuesAPI.java, which is part of the broader Scada‑LTS platform.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate severity. EPSS is not available, but the existence of a published exploit means that exploitation is demonstrated in the wild. The vulnerability can be triggered remotely via normal HTTP requests, and the attack is not limited by technical restrictions. The vulnerability is not listed in the CISA KEV catalog, yet the remote nature and existence of exploit code warrant attention.

Generated by OpenCVE AI on October 24, 2026 at 08:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Scada‑LTS to the new release that contains the vendor’s security patches for the AmCharts Data API
  • If an upgrade is not immediately feasible, block or restrict access to the AmChartValuesAPI endpoints to trusted IP ranges only to reduce attack surface
  • Implement input validation or access‑control checks for the "ids" parameter in AmChartValuesAPI, ensuring that only authorized users can specify or modify the requested data

Generated by OpenCVE AI on October 24, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
Title Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
First Time appeared Scada-lts
Scada-lts scada-lts
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*
Vendors & Products Scada-lts
Scada-lts scada-lts
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Scada-lts Scada-lts
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-24T06:45:07.253Z

Reserved: 2026-10-23T15:14:35.243Z

Link: CVE-2026-115803

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-24T07:16:46.637

Modified: 2026-10-24T07:16:46.793

Link: CVE-2026-115803

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T08:30:10Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key