View CSAF
Summary
Successful exploitation of these vulnerabilities may allow remote code execution.
The following versions of InSAT MasterSCADA BUK-TS are affected:
MasterSCADA BUK-TS vers:all/* (CVE-2026-21410, CVE-2026-22553)
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.8
InSAT
InSAT MasterSCADA BUK-TS
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Background
Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Russia
Vulnerabilities
Expand All +
CVE-2026-21410
InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.
View CVE Details
Affected Products
InSAT MasterSCADA BUK-TS
Vendor: InSAT
Product Version: InSAT MasterSCADA BUK-TS: vers:all/*
Product Status: known_affected
Remediations
Mitigation InSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.
Mitigation InSAT has not responded to requests to work with CISA to mitigate these vulnerabi...