PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10057 ITP Technology CVE debrief

ITS Intelligent SCADA System developed by ITP Technology contains a stored cross-site scripting (XSS) vulnerability. A privileged remote attacker can inject persistent JavaScript that executes in users' browsers when affected pages are loaded. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack timing requirements, high privileges required, and user interaction required, with low impacts to confidentiality and integrity subscopes. The CVE was published on 2026-05-29 and currently holds a Deferred status in the NVD.

Vendor
ITP Technology
Product
ITS Intelligent SCADA System
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations operating ITS Intelligent SCADA Systems, particularly in critical infrastructure and industrial control environments, should prioritize this vulnerability. Security teams responsible for OT/IT convergence environments, SCADA administrators, and compliance officers in sectors dependent on industrial automation should assess exposure and apply defensive controls.

Technical summary

The ITS Intelligent SCADA System fails to properly neutralize user input before rendering it in web pages, resulting in stored cross-site scripting (CWE-79). An attacker with high privileges can inject persistent JavaScript payloads that execute in the context of other users' browsers upon page load. The CVSS 4.0 score of 4.8 (MEDIUM) reflects the high privilege requirement and user interaction needed, limiting broad exploitability but not eliminating risk to authenticated sessions.

Defensive priority

medium

Recommended defensive actions

  • Apply security patches from ITP Technology when available
  • Implement Content Security Policy (CSP) headers to mitigate XSS impact
  • Validate and sanitize all user-supplied input, especially from privileged accounts
  • Review and restrict administrative privileges to reduce attack surface
  • Monitor for unauthorized script injection in SCADA web interfaces
  • Conduct security assessment of stored data rendered in web interfaces

Evidence notes

The vulnerability description and CVSS scoring are sourced from the official NVD record. Advisory references are provided by Taiwan CERT (TWCERT). Vendor attribution to ITP Technology is derived from the CVE description; the vendor field in source metadata is marked low-confidence and flagged for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10057 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10057

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10057 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10057

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.