The vulnerability allows authenticated users to inject and run arbitrary JavaScript code on the SCADA server. Scripts execute with full system privileges, effectively giving the attacker root access and the ability to perform any command or modify critical infrastructure. The weakness corresponds to CWE-78, reflecting insecure execution of system commands without proper validation.

ScadaBR ScadaBR is the affected product. No specific version information is provided, so all released iterations are potentially vulnerable until an official patch is applied.

The CVSS score of 9.9 indicates critical severity. EPSS is not available, but the lack of listing in the CISA KEV catalog does not diminish the risk: authenticated users can enact arbitrary code, making exploitation straightforward once access is obtained. The likely attack vector is through legitimate user credentials, implying that internal or compromised accounts can be leveraged to compromise the system.