ScadaLTS 2.8.1-release-candidate build 0 is vulnerable to authenticated remote code execution via a scripting sandbox bypass. The issue is in the DWR "DataSourceEditDwr" class, specifically the "validateScript" method, which compiles and executes JavaScript using the Rhino engine without proper authorization checks. Attackers with low privilege user access can exploit this by leveraging a DWR routing bypass to execute arbitrary code on the system.

Successful exploitation allows an attacker with low privilege authenticated access to execute arbitrary code remotely, potentially leading to full system compromise. The CVSS 3.1 base score is 8.8 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected functionality to trusted users only and monitor for suspicious activity involving the DWR "DataSourceEditDwr" class. Avoid exposing the vulnerable interface to untrusted networks.