InSAT MasterSCADA BUK-TS OS Command Injection Vulnerability Allowing Remote Code Execution

A vulnerability exists in all versions of InSAT MasterSCADA BUK-TS, allowing for OS command injection via a field in the MMadmServ web interface. This flaw could enable remote code execution by malicious users who exploit the vulnerable endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized OS command execution, potentially allowing an attacker to execute arbitrary code on the server where InSAT MasterSCADA BUK-TS is running.

Remediation

InSAT has not responded to requests to collaborate with CISA on mitigating these vulnerabilities. Users are encouraged to contact InSAT via email for more information.