An OS Command Injection flaw exists in version 1.2.0 of ScadaBR that allows an attacker to run arbitrary system commands with root privileges on the SCADA host. The vulnerability arises from failure to properly neutralize special elements in user-controlled input that is passed to an operating system command line. Successful exploitation would compromise confidentiality, integrity, and availability of the entire SCADA infrastructure, allowing an attacker to alter system state, exfiltrate data, or disrupt operations.

The affected product is ScadaBR by ScadaBR. Only the 1.2.0 release is known to contain the flaw. Other releases are not listed as vulnerable.

The CVSS score of 8.7 indicates a high severity. EPSS data is not available, so the likelihood of exploitation is uncertain, but the existence of the flaw and the call for root execution suggest a potentially high exploitation risk. The vulnerability is not yet in the CISA KEV catalog, but that does not diminish the need for mitigation. Attackers could trigger the flaw remotely by submitting malicious input to the affected component, enabling execution commands as the system owner. Early exploitation precedence indicates that the flaw could be leveraged with minimal technical barriers as long as the SCADA system is reachable.