CVE-2025-70973: ScadaBR Session Fixation Vulnerability

CVE-2025-70973 Overview

A session fixation vulnerability exists in ScadaBR 1.12.4, an open-source SCADA (Supervisory Control and Data Acquisition) system. The application assigns a JSESSIONID session cookie to unauthenticated users and fails to regenerate the session identifier after successful authentication. This design flaw allows an attacker who knows or controls a session ID to hijack an authenticated session once a victim logs in using that same session.

Critical Impact

Attackers can hijack authenticated sessions in ScadaBR SCADA systems, potentially gaining unauthorized access to industrial control system interfaces and sensitive operational data.

Affected Products

• ScadaBR 1.12.4

Discovery Timeline

• 2026-03-09 - CVE CVE-2025-70973 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-70973

Vulnerability Analysis

This vulnerability is classified under CWE-384 (Session Fixation). The core issue lies in ScadaBR's session management implementation, which violates secure session handling best practices. When a user first accesses the application, a JSESSIONID cookie is assigned to establish a session. However, when that same user subsequently authenticates, the application does not invalidate the existing session and create a new one. Instead, the pre-authentication session simply becomes elevated to an authenticated state.

This behavior creates an exploitable window where an attacker can obtain or set a session identifier before authentication occurs, then wait for the victim to authenticate using that session. The network-based attack vector requires high complexity to execute successfully, as the attacker must position themselves to influence or capture the victim's session ID before login.

Root Cause

The root cause is the absence of session regeneration logic in ScadaBR's authentication workflow. Proper session management requires that web applications invalidate the current session and issue a new session identifier immediately after successful authentication. ScadaBR 1.12.4 skips this critical step, allowing pre-authentication sessions to persist and inherit authenticated privileges.

Attack Vector

An attacker can exploit this vulnerability through several techniques:

1. Session ID Injection: If the application accepts session identifiers via URL parameters or can be influenced through cross-site attacks, the attacker can force a victim to use a known session ID before authentication.

2. Network Interception: In scenarios where the attacker has network visibility (e.g., shared Wi-Fi, compromised network segment), they can capture the JSESSIONID cookie assigned to an unauthenticated user's session.

3. Phishing/Social Engineering: The attacker crafts a link containing a fixed session ID and tricks the victim into using it to access ScadaBR. Once the victim authenticates, the attacker uses the same session ID to access the authenticated session.

The attack requires the attacker to either control or observe the victim's session before authentication occurs, then use that same session ID after the victim logs in to gain access to the authenticated session. This provides the attacker with whatever access level the victim possesses within the ScadaBR system.

Detection Methods for CVE-2025-70973

Indicators of Compromise

• Multiple authentication events from different IP addresses using the same JSESSIONID value
• Session cookies being used from geographically disparate locations within short time frames
• Concurrent active sessions for a single user account where one session lacks initial authentication logs

Detection Strategies

• Monitor authentication logs for session IDs that were assigned before authentication but continue to be used after successful login from different source IPs
• Implement alerting for session tokens observed in pre-authentication traffic that subsequently appear in authenticated requests from different clients
• Review web server access logs for patterns indicating session ID sharing or reuse across multiple client fingerprints

Monitoring Recommendations

• Enable detailed session tracking and logging for all ScadaBR authentication events
• Deploy network monitoring to detect anomalous session behavior patterns
• Consider implementing user behavior analytics to identify session hijacking attempts

How to Mitigate CVE-2025-70973

Immediate Actions Required

• Restrict network access to ScadaBR instances to trusted networks only using firewall rules or network segmentation
• Implement additional authentication factors where possible to reduce the impact of session hijacking
• Monitor active sessions closely and consider implementing shorter session timeouts
• Review access logs for signs of exploitation

Patch Information

No vendor patch information is currently available for this vulnerability. Users should monitor the GitHub SCADA Project README for updates and security advisories.

Workarounds

• Deploy ScadaBR behind a reverse proxy that can be configured to regenerate session identifiers after authentication
• Implement IP-binding for sessions at the network or application gateway level to prevent session use from different IP addresses
• Use HTTPS exclusively to prevent session ID interception via network eavesdropping
• Consider implementing custom authentication wrappers that invalidate and regenerate sessions post-authentication

Since no verified code examples are available for this vulnerability, administrators should consult the external references for detailed technical information. For session fixation mitigation at the application server level, Java servlet containers like Tomcat can be configured to change session IDs upon authentication by enabling changeSessionIdOnAuthentication in the container's security configuration. However, this requires access to the underlying application server configuration and may not be sufficient if the application itself manages sessions differently.