CVE-2021-26828
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
Description
CVE-2021-26828 is a high-severity unrestricted file upload vulnerability in OpenPLC ScadaBR, an open-source SCADA (Supervisory Control and Data Acquisition) system used for industrial process monitoring and control. The vulnerability affects ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows, allowing remote authenticated users to upload and execute arbitrary JSP files via the view_edit.shtm endpoint. With a CVSS v3.1 base score of 8.8, successful exploitation grants attackers the ability to execute arbitrary code on the server hosting the SCADA system. CISA has added CVE-2021-26828 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 24, 2025, and the EPSS score of 80.02% at the 99.1st percentile indicates near-certain exploitation probability, placing it among the most actively targeted industrial control system vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| scadabr | scadabr | <= 0.9.1; <= 1.12.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4(Broken Link, Exploit, Vendor Advisory)
- http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html(Exploit, Third Party Advisory)
- https://youtu.be/k1teIStQr1A(Exploit, Third Party Advisory)
- https://github.com/SCADA-LTS/Scada-LTS/pull/2174(Issue Tracking, Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2021-26828 is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical weakness that occurs when a web application allows users to upload files without properly restricting the file type, content, or destination. In ScadaBR, the view_edit.shtm endpoint accepts file uploads as part of the view editing functionality. The application fails to validate that uploaded files are restricted to safe types such as images or configuration files, and instead allows the upload of JSP (JavaServer Pages) files. Since JSP files are executable by the application server (typically Apache Tomcat), an attacker can upload a webshell or arbitrary Java code that executes with the privileges of the SCADA application. Learn more about CWE-434
Impact Analysis
The exploitation of CVE-2021-26828 in a SCADA environment carries exceptional risk due to the critical nature of industrial control systems. Confidentiality is fully compromised as an attacker executing arbitrary code on the SCADA server gains access to process data, sensor readings, control parameters, historian databases, user credentials, and network configuration of the industrial environment. This data reveals operational details about the physical processes being monitored, which can be leveraged for more targeted attacks against the industrial infrastructure.
Integrity faces maximum impact because code execution on the SCADA server enables modification of process control parameters, alarm thresholds, displayed values, and operational logic. In industrial environments, integrity compromise can have physical safety implications if operators receive falsified data or if control commands are modified without their knowledge.
Availability is critically threatened since attackers can disable the SCADA monitoring and control system, corrupt the database, or deploy ransomware that encrypts the SCADA server. Loss of visibility and control over industrial processes can result in production shutdowns, equipment damage, or safety incidents. The EPSS score of 80.02% at the 99.1st percentile reflects the extraordinary exploitation likelihood. Public exploit code is readily available at Packet Storm Security and demonstrated via video proof-of-concept, lowering the barrier to exploitation substantially.
Exploit Maturity
CVE-2021-26828 exhibits extremely high exploit maturity. The EPSS score of 80.02% at the 99.1st percentile places it in the top 1% of all vulnerabilities for exploitation probability, indicating widespread and sustained exploitation. CISA has confirmed active exploitation by including it in the Known Exploited Vulnerabilities catalog.
Public exploit code has been available since 2021. A complete shell upload exploit is published at Packet Storm Security, providing attackers with ready-to-use exploitation tools. A video demonstration of the exploit further lowers the skill barrier for attackers. The Scada-LTS project has acknowledged the vulnerability with a patch in pull request #2174. While the ransomware association is currently classified as unknown, the targeting of SCADA systems by threat actors has increased dramatically, and the combination of readily available exploits with the high value of industrial control targets makes this vulnerability particularly attractive to both criminal groups and nation-state actors seeking to disrupt critical infrastructure.
Remediation
-
Migrate to Scada-LTS which contains the security fix. The original ScadaBR project is no longer actively maintained, and the community has transitioned to the Scada-LTS fork which addressed this vulnerability in pull request #2174. Ensure you are running a version that includes this fix.
-
Implement network segmentation to isolate the SCADA server from untrusted networks immediately. ScadaBR should never be directly accessible from the internet. Place the SCADA system in a dedicated OT (Operational Technology) network zone with strict firewall rules permitting only necessary connections from authorized management workstations.
-
Restrict and audit user accounts on the ScadaBR system. Review all user accounts, remove unnecessary accounts, and enforce the principle of least privilege. Since the vulnerability requires authentication, reducing the number of users with access to the view_edit.shtm functionality directly reduces the attack surface.
-
Deploy application-level controls including a reverse proxy or web application firewall that blocks upload requests containing JSP content or other executable file types. Configure the application server (Tomcat) to disallow execution of uploaded files by restricting the directories where uploaded content is stored to non-executable paths.
-
Conduct a forensic review of all ScadaBR installations that were running vulnerable versions while network-accessible. Search for unauthorized JSP files in web-accessible directories, review access logs for requests to view_edit.shtm with file upload parameters, and check for evidence of webshell activity or unauthorized process execution.
Technical Details
CVE-2021-26828 is an unrestricted file upload vulnerability in OpenPLC ScadaBR. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, producing a base score of 8.8.
The vector breakdown explains the attack characteristics. Attack Vector (AV:N) confirms remote network-based exploitation. Attack Complexity (AC:L) indicates straightforward exploitation with no special prerequisites. Privileges Required (PR:L) means any authenticated user with basic access to the ScadaBR web interface can exploit the vulnerability, not just administrators. User Interaction (UI:N) confirms no victim participation is needed. Scope (S:U) indicates the impact is contained to the vulnerable system, though in practice a compromised SCADA server provides significant leverage within the OT network.
The attack mechanism targets the view_edit.shtm endpoint in ScadaBR, which provides functionality for editing graphical views within the SCADA interface. This endpoint accepts file uploads to allow users to add images or other resources to their views. The vulnerability exists because the server does not validate the type of uploaded files, allowing an attacker to upload a JSP file instead of an expected image file. JSP files are interpreted and executed by the underlying Java application server (typically Apache Tomcat). Once uploaded, the attacker can access the JSP file via a direct HTTP request to its known path, triggering server-side execution of the arbitrary Java code contained within. Affected versions include ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows, with the distinction reflecting different release tracks for the two platforms.
Frequently Asked Questions
What is CVE-2021-26828?
CVE-2021-26828 is an unrestricted file upload vulnerability in OpenPLC ScadaBR, an open-source SCADA system for industrial monitoring and control. It allows authenticated users to upload and execute arbitrary JSP files on the server through the view_edit.shtm endpoint, enabling full remote code execution.
Why is a SCADA vulnerability from 2021 still critical today?
Despite being discovered in 2021, CVE-2021-26828 was added to CISA's KEV catalog in 2025 because exploitation continues in the wild. Many ScadaBR installations in industrial environments are not regularly updated due to operational constraints, and publicly available exploit code makes it trivially exploitable.
Which versions of ScadaBR are affected?
ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows are vulnerable. The recommended path forward is migrating to the actively maintained Scada-LTS fork which includes the security fix.
Can this vulnerability be exploited by any authenticated user?
Yes. The CVSS vector specifies low privileges required (PR:L), meaning any user with basic authentication to the ScadaBR web interface can exploit the vulnerability. Administrative access is not required, which significantly expands the potential attacker pool.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.