Actively exploited in the wild

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC - ScadaBR · Listed in the CISA KEV since 2025-12-03. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2021-26828

HighCVSS 8.8KEV

Published: 11/06/2021(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Risk Assessment

An authenticated attacker can execute arbitrary code on the server, leading to full SCADA system compromise and potential industrial infrastructure impact.

Recommendation

Update OpenPLC ScadaBR to the latest version, restrict access to the web interface, and review privileged accounts.

Other vulnerabilities in OpenPLC ScadaBR

CVE-2021-26829MediumActively exploited
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Original NVD description (English source)

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS