CVE-2026-10057
Stored XSS in ITS Intelligent SCADA System
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: TWCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itp_technology | its_intelligent_scada_system | From 2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-10057 is a stored cross-site scripting (XSS) vulnerability in the ITS Intelligent SCADA System developed by ITP Technology. It allows privileged remote attackers to inject persistent JavaScript code into specific pages of the system.
When users visit these compromised pages, the injected JavaScript code executes automatically in their browsers, potentially leading to unauthorized actions or data theft.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized actions or data theft because the injected JavaScript code runs in users' browsers when they load affected pages.
The impact includes low confidentiality and integrity loss, meaning some sensitive information could be exposed or altered, but there is no impact on system availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the stored cross-site scripting vulnerability in the ITS Intelligent SCADA System affects compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability allows privileged remote attackers to inject persistent JavaScript code that executes in users' browsers, leading to potential unauthorized actions or data theft.
Immediate mitigation steps include restricting administrative access to trusted users only, ensuring that only authorized personnel have high privileges required to perform actions in the system.
Additionally, applying any available patches or updates from the vendor for ITS Intelligent SCADA System version 2.1 is recommended once released.
Monitoring user activity for suspicious behavior and educating users about the risks of interacting with untrusted content can also help reduce impact.