The MasterSCADA BUK‑TS system is exposed to a classic SQL Injection flaw through its primary web interface. Attackers who can reach the vulnerable endpoint can inject malicious SQL statements that may ultimately lead to remote code execution, granting them full control over the compromised host and the underlying SCADA infrastructure.

The affected product is InSAT MasterSCADA BUK‑TS. No specific version information is provided, so all installations of this SCADA suite should be evaluated for exposure.

The CVSS base score of 9.3 indicates a high‑severity vulnerability that affects confidentiality, integrity, and availability. Although the EPSS score is reported as less than 1%, this does not mean the risk is negligible; the vulnerability remains actively exploitable over the web interface. It is not currently listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The likely attack vector is external, via the web interface, and requires only authenticated or unauthenticated HTTP access, depending on the deployment configuration.