High severity · published Nov 30, 2025
CVE-2025-13790
Scada-LTS cross-site request forgery
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Scada-LTS · Scada-lts
2.7.8.0; 2.7.8.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13790
Exploit
https://github.com/Xzzz111/exps/blob/main/archives/Scada-LTS-CSRF-1/report.md
Exploit
https://github.com/Xzzz111/exps/blob/main/archives/Scada-LTS-CSRF-1/report.md#proof-of-concept
Permissions Required
https://vuldb.com/?ctiid.333794
Third Party Advisory
https://vuldb.com/?id.333794
Third Party Advisory
https://vuldb.com/?submit.690871
More from Scada-LTS
9.9
CVE-2026-19656
ScadaLTS Authenticated Remote Code Execution
8.8
CVE-2026-84860
Scada-LTS DWR Authorization Bypass - Systemic
8.8
CVE-2026-84858
Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass
8.8
CVE-2023-33472
An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code,…
8.8
CVE-2022-41976
An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privileged user to change…