The vulnerability is a Cross‑Site Request Forgery (CWE‑352) that exists in ScadaBR version 1.2.0. An attacker can entice a logged‑in user to a malicious website that automatically submits requests to the SCADA system, and because those requests carry the victim’s authentication credentials, the application treats them as legitimate actions. This allows the attacker to trigger any operation that the authenticated user is allowed to perform, potentially leading to unauthorized changes, data manipulation, or disruption of system operations.

ScadaBR version 1.2.0, owned by the vendor ScadaBR:ScadaBR, is the affected product. No additional products or versions are listed in the advisory.

The CVSS base score is 8.6, indicating high severity, while the EPSS score is not available and the issue is not listed in CISA KEV. The attack vector is inferred to be web‑based, requiring the victim to be authenticated and to visit a malicious webpage that automatically submits a request. The exploit does not require network privileges; it relies on the victim’s browser to send authenticated requests to the application, enabling the attacker to perform any privileged function the user can.