The ITS Intelligent SCADA System version 2.1 contains a stored cross-site scripting vulnerability (CWE-79) that permits privileged remote attackers to inject persistent JavaScript code into web pages generated by the system. This injected code executes in the context of users' browsers upon page load, potentially leading to unauthorized actions or data exposure within the affected application. The vulnerability has a CVSS 4.0 score of 4.8, reflecting medium severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows privileged remote attackers to inject persistent JavaScript code that executes in users' browsers, which could lead to unauthorized actions performed on behalf of users or exposure of sensitive information within the SCADA system interface. However, the vulnerability requires privileged access to exploit and does not involve user interaction beyond page load. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting privileged access and carefully validating input before it is stored or rendered may help reduce risk.