1. Forum
  2. TCOB1
  3. CISA Advisories

  • InSAT MasterSCADA BUK-TS

    From CISA Advisories@2:263/1 to All on Tue Feb 24 18:11:05 2026
    InSAT MasterSCADA BUK-TS

    View CSAF
    Summary
    Successful exploitation of these vulnerabilities may allow remote code execution.
    The following versions of InSAT MasterSCADA BUK-TS are affected:

    MasterSCADA BUK-TS vers:all/* (CVE-2026-21410, CVE-2026-22553)





    CVSS
    Vendor
    Equipment
    Vulnerabilities




    v3 9.8
    InSAT
    InSAT MasterSCADA BUK-TS
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')




    Background

    Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater
    Countries/Areas Deployed: Worldwide
    Company Headquarters Location: Russia


    Vulnerabilities

    Expand All +

    CVE-2026-21410

    InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.
    View CVE Details

    Affected Products
    InSAT MasterSCADA BUK-TS

    Vendor:InSAT
    Product Version:InSAT MasterSCADA BUK-TS: vers:all/*
    Product Status:known_affected


    Remediations
    MitigationInSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.
    MitigationInSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.

    Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    9.8
    CRITICAL
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H







    CVE-2026-22553

    All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.
    View CVE Details

    Affected Products
    InSAT MasterSCADA BUK-TS

    Vendor:InSAT
    Product Version:InSAT MasterSCADA BUK-TS: vers:all/*
    Product Status:known_affected


    Remediations
    MitigationInSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.
    MitigationInSAT has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact info@insat.ru or scada@insat.ru for additional information.

    Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Metrics




    CVSS Version
    Base Score
    Base Severity
    Vector String




    3.1
    9.8
    CRITICAL
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H








    Acknowledgments

    Adem El Adeb reported these vulnerabilities to CISA


    Legal Notice and Terms of Use
    This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

    Recommended Practices
    CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
    Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
    Locate control system networks and remote devices behind firewalls and isolating them from business networks.
    When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
    CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
    CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
    CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
    Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
    Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
    No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

    Revision History

    Initial Release Date: 2026-02-24




    Date
    Revision
    Summary




    2026-02-24
    1
    Initial Publication




    Legal Notice and Terms of Use

    https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-01

    2026-02-24 12:00 UTC
    --- FMail-lnx 2.3.2.6-B20251227
    * Origin: TCOB1 A Mail Only System (2:263/1)