CVE-2021-26829
OpenPLC ScadaBR Cross-site Scripting Vulnerability
Description
CVE-2021-26829 is a medium-severity stored cross-site scripting (XSS) vulnerability in OpenPLC ScadaBR, an open-source SCADA system used for industrial process monitoring. Affecting ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows, the vulnerability allows authenticated users to inject persistent malicious scripts via the system_settings.shtm page. With a CVSS v3.1 base score of 5.4, the stored nature of this XSS means injected scripts execute in the browsers of any user who accesses the affected settings page. CISA has added CVE-2021-26829 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 19, 2025, and the EPSS score of 13.57% at the 94.1st percentile indicates very high exploitation probability for a cross-site scripting vulnerability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| scadabr | scadabr | <= 0.9.1; <= 1.12.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4(Vendor Advisory)
- https://youtu.be/Xh6LPCiLMa8(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26829(US Government Resource)
- https://www.forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/(Third Party Advisory)
Weakness Type
CWE-79: Cross-site Scripting (XSS)
CVE-2021-26829 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as cross-site scripting. This weakness occurs when a web application includes user-supplied data in its web page output without proper encoding or validation, allowing attackers to inject client-side scripts that execute in other users' browsers. In ScadaBR, the system_settings.shtm page stores user input that is later rendered in the browser without adequate output encoding. Because this is a stored (persistent) XSS variant, the malicious payload is saved on the server and automatically delivered to every user who views the affected page, making it more dangerous than reflected XSS which requires user interaction with a crafted URL. Learn more about CWE-79
Impact Analysis
The impact of CVE-2021-26829 is amplified by the SCADA context in which ScadaBR operates. Confidentiality faces low direct impact from the XSS itself, but in a SCADA environment, stolen session cookies or credentials can grant attackers access to industrial control interfaces, process data, alarm configurations, and operational parameters. The changed scope (S:C) in the CVSS vector indicates the vulnerability impacts resources beyond the vulnerable component, specifically the browsers and sessions of other users who view the compromised settings page.
Integrity is rated as low impact in the CVSS assessment, reflecting the ability to modify web page content in the victim's browser. However, in a SCADA context, XSS can be used to present falsified process data, suppress alarms, inject fake readings, or modify the displayed state of industrial systems, potentially leading operators to make incorrect decisions about physical processes.
The EPSS score of 13.57% at the 94.1st percentile is remarkably high for a stored XSS vulnerability, indicating significant real-world exploitation interest. Security researchers at Forescout have documented this vulnerability in a report on Russian-aligned hacktivist attacks targeting OT/ICS systems, demonstrating that threat actors are actively targeting SCADA systems including ScadaBR. A video demonstration of the exploit is publicly available. While the ransomware association is classified as unknown, the combination of SCADA targeting and hacktivist exploitation underscores the real-world threat.
Exploit Maturity
CVE-2021-26829 demonstrates high exploit maturity, particularly notable given the SCADA/ICS context. The EPSS score of 13.57% at the 94.1st percentile places this among the most likely-to-be-exploited XSS vulnerabilities. CISA has confirmed active exploitation through KEV catalog inclusion.
A public video exploit demonstration is available, providing step-by-step exploitation guidance that significantly lowers the skill barrier. Forescout published a detailed analysis of a Russian-aligned hacktivist group targeting OT/ICS systems that specifically references this vulnerability, demonstrating real-world exploitation by threat actors motivated by geopolitical objectives. The ransomware association is classified as unknown, but the hacktivist exploitation context reveals that SCADA vulnerabilities are being weaponized as part of broader campaigns against critical infrastructure. The vendor advisory is available at the ScadaBR forum, though this link is noted as broken, reflecting the challenges of maintaining security communications for open-source SCADA projects.
Remediation
-
Migrate to Scada-LTS which is the actively maintained fork of ScadaBR and includes security fixes for this and other vulnerabilities. The original ScadaBR project is no longer actively maintained, making migration the most effective long-term remediation strategy.
-
Implement network isolation for ScadaBR installations immediately. The SCADA web interface should only be accessible from a dedicated management network segment. Configure firewall rules to block access from general corporate networks and the internet. Use VPN or jump hosts for remote access when absolutely necessary.
-
Restrict user access to the system_settings.shtm page by limiting the number of users with administrative access to ScadaBR. Implement role-based access controls to ensure only designated administrators can modify system settings. Audit existing user accounts and remove any that are unnecessary.
-
Deploy Content Security Policy headers on the ScadaBR web server to restrict script execution. A properly configured CSP can prevent injected XSS payloads from executing even if the underlying vulnerability exists, providing defense in depth while migration to a patched version is completed.
-
Monitor for exploitation indicators by reviewing ScadaBR access logs for suspicious modifications to system settings and unusual JavaScript content in stored configuration values. Given the documented hacktivist targeting, organizations should also monitor for indicators of compromise associated with the threat groups described in the Forescout analysis.
Technical Details
CVE-2021-26829 is a stored cross-site scripting vulnerability in OpenPLC ScadaBR. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, producing a base score of 5.4.
The vector analysis reveals the characteristics of a stored XSS attack. Attack Vector (AV:N) confirms remote exploitation over the network through the ScadaBR web interface. Attack Complexity (AC:L) indicates straightforward exploitation. Privileges Required (PR:L) means the attacker needs basic authentication to ScadaBR to inject the malicious payload. User Interaction (UI:R) is required because a victim user must navigate to the compromised settings page for the XSS to trigger. Scope (S:C) is changed, indicating the vulnerable component (ScadaBR server) is different from the impacted component (victim's browser). Confidentiality (C:L) and Integrity (I:L) reflect the limited but real impact of client-side script execution, while Availability (A:N) indicates no direct availability impact.
The vulnerability exists in the system_settings.shtm page of ScadaBR. When an authenticated user submits data through the system settings interface, the application stores the input without sanitizing HTML or JavaScript content. When another user navigates to the system settings page, the stored data is rendered in the browser without output encoding, causing any embedded JavaScript to execute in the context of the viewing user's session. This enables the attacker to steal session cookies, perform actions on behalf of the victim user, modify the displayed SCADA interface, or redirect the user to malicious sites. The stored nature of the XSS makes it persistent and self-propagating to any user who views the settings page.
Frequently Asked Questions
What is CVE-2021-26829?
CVE-2021-26829 is a stored cross-site scripting vulnerability in OpenPLC ScadaBR that allows authenticated users to inject malicious JavaScript through the system_settings.shtm page. The injected script executes in the browsers of other users who view the settings page.
Why is a cross-site scripting vulnerability in a SCADA system especially dangerous?
In SCADA environments, XSS can be used to steal operator credentials, present falsified process data, suppress critical alarms, or modify displayed industrial readings. Operators making decisions based on manipulated displays could take actions that endanger physical safety or equipment integrity.
Has CVE-2021-26829 been exploited by hacktivist groups?
Yes. Forescout has documented exploitation of ScadaBR vulnerabilities by Russian-aligned hacktivist groups targeting OT/ICS systems. This demonstrates that even medium-severity vulnerabilities in industrial control systems attract motivated threat actors.
How do I fix CVE-2021-26829?
The recommended remediation is migrating to Scada-LTS, the actively maintained community fork of ScadaBR that includes security fixes. The original ScadaBR project is no longer actively maintained, so applying patches to the legacy software is not a viable long-term strategy.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.