Actively exploited · Published Jun 11, 2021 · Assigned by mitre
CVE-2021-26828
High 8.8 Exploited
In plain English
A high-severity unrestricted file upload in ScadaBR from OpenPLC. Attackers are actively exploiting it in the wild (listed by CISA on December 3, 2025). The chance it is exploited in the next 30 days is estimated at 39.1% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 24, 2025.
Official description
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://youtu.be/k1teIStQr1A x_refsource_MISC
- http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html x_refsource_MISC
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828 government-resource
- https://github.com/SCADA-LTS/Scada-LTS/pull/2174 issue-tracking