CVE DatabaseCVE-2021-26828

Updated 2026-06-17한국어 권고문 →

CVE-2021-268288.8/HIGHCISA KEVCWE-434

OpenPLC ScadaBR Arbitrary File Upload and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2021-26828)

⚡ Jump to Patch

Affected Vendors

openplc

Affected Components

scadabr

Published Date

2021-06-11

CVSS v3.1

8.8

HIGH

EPSS (30d)

39.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows

Impact

Remote authenticated attackers can upload and execute malicious JSP files, leading to complete system compromise and arbitrary code execution

Mitigation

Apply the latest security patches, restrict external access to the ScadaBR interface, and block unauthorized JSP uploads via WAF rules

Affected Products & Version Scope

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Upgrade ScadaBR to the latest secure version. Below is an example of how to stop the vulnerable container, backup the configuration, and rebuild ScadaBR from the official repository.

bash

# Backup and stop the existing ScadaBR container
docker stop scadabr-container
docker commit scadabr-container scadabr-backup-image

# Clone and build the latest secure version of ScadaBR
git clone https://github.com/thiagoralves/ScadaBR.git
cd ScadaBR
mvn clean package

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, configure a reverse proxy (such as Nginx) to block POST requests to the vulnerable endpoint and restrict JSP execution in the upload directories.

nginx

# Add to your Nginx server block configuration
location ~* /view_edit\.shtm$ {
    if ($request_method = POST) {
        return 403 'POST requests to this endpoint are restricted.';
    }
}

# Prevent execution of JSP files in the webapp directory
location ~* \.jsp$ {
    deny all;
}

3. Log Audit & IoC Verification Commands

Use the following script to scan for recently modified JSP files in the web root and inspect access logs for suspicious POST requests targeting view_edit.shtm.

bash

#!/bin/bash
echo '[+] Scanning for suspicious JSP files in ScadaBR web root...'
# Adjust the path to match your Tomcat/ScadaBR installation
find /var/lib/tomcat*/webapps/ScadaBR/ -name '*.jsp' -mtime -30 -exec ls -la {} \;

echo '[+] Analyzing web server access logs for view_edit.shtm uploads...'
grep -i 'view_edit.shtm' /var/log/tomcat*/localhost_access_log*.txt | grep -i 'POST'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation (CISA KEV) and high EPSS scores, immediately restrict public access and apply the latest security updates.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-26828) is an unrestricted file upload flaw (CWE-434) residing in the file upload mechanism of OpenPLC ScadaBR. The root cause is the lack of proper validation and sanitization of file extensions and MIME types within the view_edit.shtm component. This allows authenticated users to upload arbitrary JSP (JavaServer Pages) files to the server's web directory.

2. Exploitation Mechanics & Attack Scenario

An attacker with valid credentials (even with low privileges) logs into the ScadaBR web console. By navigating to the view_edit.shtm page, the attacker uploads a crafted JSP file containing a Java web shell. Because the application fails to restrict executable file extensions, the file is saved directly in the web root. The attacker then sends an HTTP GET request to the path of the uploaded JSP file, triggering the application server to execute the malicious code and granting the attacker interactive shell access.

3. Infrastructure & Business Impact

ScadaBR is widely deployed in Industrial Control Systems (ICS) and SCADA environments for monitoring and control. This vulnerability is highly critical, as evidenced by its inclusion in the CISA KEV catalog and an EPSS score of 0.391. Successful exploitation allows attackers to gain full control over the host system, enabling them to manipulate PLC commands, alter process parameters, move laterally within the OT/IT network, and cause severe physical or operational disruption.

Official Vendor Advisories & References

NVD Original English Description

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4

Source: cve@mitre.org · Broken Link, Exploit, Vendor Advisory

http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html

Source: cve@mitre.org · Exploit, Third Party Advisory

https://youtu.be/k1teIStQr1A

Source: cve@mitre.org · Exploit, Third Party Advisory

http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4

Source: af854a3a-2127-422b-91ae-364da2661108 · Broken Link, Exploit, Vendor Advisory

http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2021-26828)

FAQ

Q1. How critical is CVE-2021-26828 and is it actively exploited in the wild?

CVE-2021-26828 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 39.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-26828?

Primary impacted vendors include openplc across scadabr. Scope summary: OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows

Q3. What temporary mitigations or workarounds exist for CVE-2021-26828 before patching?

[Mitigation] Apply the latest security patches, restrict external access to the ScadaBR interface, and block unauthorized JSP uploads via WAF rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION