Stored XSS in ITS Intelligent SCADA System

Executive Summary

CVE-2026-10057 is a stored cross-site scripting (XSS) vulnerability in the ITS Intelligent SCADA System developed by ITP Technology. It allows privileged remote attackers to inject persistent JavaScript code into specific pages of the system.

When users visit these compromised pages, the injected JavaScript code executes automatically in their browsers, potentially leading to unauthorized actions or data theft.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized actions or data theft because the injected JavaScript code runs in users' browsers when they load affected pages.

The impact includes low confidentiality and integrity loss, meaning some sensitive information could be exposed or altered, but there is no impact on system availability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability allows privileged remote attackers to inject persistent JavaScript code that executes in users' browsers, leading to potential unauthorized actions or data theft.

Immediate mitigation steps include restricting administrative access to trusted users only, ensuring that only authorized personnel have high privileges required to perform actions in the system.

Additionally, applying any available patches or updates from the vendor for ITS Intelligent SCADA System version 2.1 is recommended once released.

Monitoring user activity for suspicious behavior and educating users about the risks of interacting with untrusted content can also help reduce impact.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the stored cross-site scripting vulnerability in the ITS Intelligent SCADA System affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0