PatchSiren cyber security CVE debrief
CVE-2026-10057 ITP Technology CVE debrief
ITS Intelligent SCADA System developed by ITP Technology contains a stored cross-site scripting (XSS) vulnerability. A privileged remote attacker can inject persistent JavaScript that executes in users' browsers when affected pages are loaded. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack timing requirements, high privileges required, and user interaction required, with low impacts to confidentiality and integrity subscopes. The CVE was published on 2026-05-29 and currently holds a Deferred status in the NVD.
- Vendor
- ITP Technology
- Product
- ITS Intelligent SCADA System
- CVSS
- MEDIUM 4.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations operating ITS Intelligent SCADA Systems, particularly in critical infrastructure and industrial control environments, should prioritize this vulnerability. Security teams responsible for OT/IT convergence environments, SCADA administrators, and compliance officers in sectors dependent on industrial automation should assess exposure and apply defensive controls.
Technical summary
The ITS Intelligent SCADA System fails to properly neutralize user input before rendering it in web pages, resulting in stored cross-site scripting (CWE-79). An attacker with high privileges can inject persistent JavaScript payloads that execute in the context of other users' browsers upon page load. The CVSS 4.0 score of 4.8 (MEDIUM) reflects the high privilege requirement and user interaction needed, limiting broad exploitability but not eliminating risk to authenticated sessions.
Defensive priority
medium
Recommended defensive actions
- Apply security patches from ITP Technology when available
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
- Validate and sanitize all user-supplied input, especially from privileged accounts
- Review and restrict administrative privileges to reduce attack surface
- Monitor for unauthorized script injection in SCADA web interfaces
- Conduct security assessment of stored data rendered in web interfaces
Evidence notes
The vulnerability description and CVSS scoring are sourced from the official NVD record. Advisory references are provided by Taiwan CERT (TWCERT). Vendor attribution to ITP Technology is derived from the CVE description; the vendor field in source metadata is marked low-confidence and flagged for review.
Official resources
2026-05-29T09:16:17.310Z