CVE-2026-115328 riclolsen CVE debrief

Who should care

Defenders responsible for JSON-SCADA systems, particularly those with historian data, should assess exposure and potential impact. This includes evaluating the sensitivity of the data and the potential consequences of unauthorized access or manipulation.

Why it matters

The SQL injection vulnerability in JSON-SCADA before 0.65-alpha poses a significant risk to defenders responsible for systems with historian data, as it could lead to unauthorized access and manipulation of sensitive data. Defenders should prioritize verifying exposure, assessing potential impact, and applying patches or compensating controls.

• Potential unauthorized access to historian data
• Potential manipulation of historian data
• Need for verification of system exposure and patch application
• Potential impact on operational continuity and data integrity

Technical summary

The JSON-SCADA system, specifically versions before 0.65-alpha, contains a SQL injection vulnerability in the opcApi() function located in src/server_realtime_auth/index.js. This vulnerability allows authenticated users to inject SQL via HistoryReadRequest parameters, potentially leading to unauthorized access and manipulation of historian data. The vulnerability can be exploited through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role. Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users and historian data.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users and historian data.

Recommended defensive actions

• Verify exposure by checking if the system is running a version of JSON-SCADA less than 0.65-alpha
• Assess potential impact by evaluating the sensitivity of historian data
• Implement compensating controls, such as monitoring and restricting access to authenticated users
• Apply the patch from the vendor or upgrade to version 0.65-alpha or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in JSON-SCADA before 0.65-alpha. The vulnerability is in the opcApi() function in src/server_realtime_auth/index.js, allowing authenticated users to inject SQL via HistoryReadRequest parameters.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.