CVE-2025-10234: Scada-LTS Data Point Edit XSS Vulnerability

CVE-2025-10234 Overview

CVE-2025-10234 is a stored cross-site scripting (XSS) vulnerability in Scada-LTS versions up to 2.7.8.1. The flaw resides in the Data Point Edit Module, specifically in the /data_point_edit.shtm endpoint. Attackers can inject malicious script payloads through the Text Renderer properties argument. The vulnerability is classified under [CWE-79] and requires authenticated access with high privileges combined with user interaction. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts prior to publication.

Critical Impact
Authenticated attackers can persist malicious JavaScript in the Text Renderer properties of data points, which then executes in the browsers of other SCADA operators viewing the affected page.

Affected Products

Scada-LTS versions up to and including 2.7.8.1
Data Point Edit Module (/data_point_edit.shtm)
Text Renderer properties input handler

Discovery Timeline

2025-09-11 - CVE-2025-10234 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10234

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Scada-LTS web interface. Scada-LTS is an open-source Supervisory Control and Data Acquisition (SCADA) platform used to monitor and control industrial processes. The Data Point Edit Module allows operators to configure how data point values render in the user interface. The Text Renderer properties field accepts user input without adequate output encoding, allowing script payloads to persist in the backend datastore.

When another authenticated user later views the data point that contains the malicious renderer configuration, the injected payload executes in the victim's browser session. This can be leveraged to steal session cookies, perform actions on behalf of higher-privileged operators, or pivot within the SCADA management interface. The attack requires the attacker to already possess an account with permission to edit data points.

Root Cause

The root cause is missing or insufficient output encoding of the Text Renderer property values before they are rendered in the HTML response. Input supplied through the data point edit form is stored verbatim and later reflected into pages served by /data_point_edit.shtm and related views. This maps to CWE-79 (Improper Neutralization of Input During Web Page Generation).

Attack Vector

An authenticated attacker with data point edit privileges submits crafted JavaScript through the Text Renderer properties field. The payload persists in the Scada-LTS database. Any subsequent user opening the affected data point triggers execution of the payload under the origin of the Scada-LTS application. The attack is network-reachable and requires user interaction from the victim.

No verified exploit code is republished here. Public technical details are documented in the Medium article on Stored XSS in Scada-LTS Data Point Edit and the VulDB #323503 report.

Detection Methods for CVE-2025-10234

Indicators of Compromise

HTTP POST requests to /data_point_edit.shtm containing HTML tag characters, <script>, javascript:, or event handler attributes such as onerror= and onload= within Text Renderer property parameters.
Stored data point records whose Text Renderer configuration contains angle brackets, encoded HTML entities, or references to external script origins.
Unexpected outbound requests from operator browsers to attacker-controlled domains shortly after viewing data point configuration pages.

Detection Strategies

Inspect Scada-LTS application logs and reverse proxy logs for requests to /data_point_edit.shtm that include payload signatures associated with XSS.
Query the Scada-LTS database for stored data point records with suspicious characters in renderer property fields and review historical edits.
Correlate data point edit events with the authenticated user account, source IP, and downstream operator session activity to identify anomalies.

Monitoring Recommendations

Enable audit logging for all configuration changes to data points, including who modified the Text Renderer properties and when.
Monitor privileged Scada-LTS accounts for atypical editing behavior, off-hours activity, or logins from unfamiliar network locations.
Deploy Content Security Policy (CSP) reporting to surface script execution attempts originating from unexpected sources within the Scada-LTS interface.

How to Mitigate CVE-2025-10234

Immediate Actions Required

Restrict access to the Scada-LTS web interface to trusted operator networks using firewall rules or VPN gating until a patched build is available.
Reduce the number of accounts with data point edit privileges to the minimum necessary and review existing grants.
Audit existing data points for suspicious content in Text Renderer property fields and remove any injected payloads.
Force session termination and credential rotation for accounts suspected of having viewed compromised data point pages.

Patch Information

At the time of publication, no vendor advisory or fixed release has been published in the NVD record. The reporter noted that the Scada-LTS project was contacted but did not respond. Operators should track the Scada-LTS project repository for future releases beyond version 2.7.8.1 that address the Text Renderer input handling.

Workarounds

Place a web application firewall (WAF) in front of Scada-LTS with rules that reject HTML and script metacharacters in POST parameters to /data_point_edit.shtm.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the Scada-LTS origin only.
Segment the SCADA management network so operator workstations viewing the interface cannot reach arbitrary external hosts, limiting exfiltration paths.
Require operators to use dedicated, hardened browsers or workstations for Scada-LTS access, isolating session cookies from general-purpose browsing.

bash

# Example nginx reverse proxy rule to block obvious XSS payloads on the edit endpoint
location /data_point_edit.shtm {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "(<script|javascript:|onerror=|onload=|<img[^>]+src=)") {
            set $block 1;
        }
        if ($block = 1) {
            return 403;
        }
    }
    proxy_pass http://scada_lts_backend;
}