CVE-2021-26829: OpenPLC ScadaBR Stored XSS Now Actively Exploited, Added to CISA KEV Catalog

Forum topic · ✨步子哥 · 2025-11-30

Summary

On November 28, 2025, CISA added CVE-2021-26829, a stored cross-site scripting (XSS) vulnerability (CWE-79) in OpenPLC ScadaBR, to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The flaw resides in the system_settings.shtm page of ScadaBR, an open-source SCADA system commonly paired with the OpenPLC programmable logic controller platform in manufacturing, energy, and water treatment environments. Attackers with sufficient access can inject malicious JavaScript or HTML into system settings fields; the payload is stored and executes in the browser session context of subsequent administrators, enabling session hijacking, credential theft, and tampering with industrial HMI configurations. Despite a moderate CVSS v3 score of 5.4, the vulnerability poses outsized risks in operational technology (OT) networks, where legacy SCADA deployments are slow to patch and exposure can translate into physical process disruption. Affected versions include ScadaBR 0.9.1 and earlier on Linux and 1.12.4 Build and earlier on Windows. Federal agencies must apply fixes by December 19, 2025, under BOD 22-01. Recommended mitigations include migrating to patched Scada-LTS builds, network segmentation, WAF deployment, and enhanced monitoring.

Overview

On November 28, 2025, CISA added CVE-2021-26829 — a stored cross-site scripting (XSS) vulnerability in OpenPLC ScadaBR — to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild roughly four years after the flaw was first documented.

Background: OpenPLC and ScadaBR

OpenPLC is an open-source programmable logic controller (PLC) platform supporting IEC 61131-3 programming languages, popularly deployed on low-cost hardware such as the Raspberry Pi.
ScadaBR is an open-source SCADA/HMI system that visualizes data from OpenPLC, typically communicating over the Modbus protocol. It is used in manufacturing, energy, and water treatment facilities.

The Vulnerability

CVE-2021-26829 (CWE-79) resides in the system_settings.shtm system settings page of ScadaBR. The page fails to sanitize/escape user-supplied input, allowing an attacker to inject malicious JavaScript or HTML that is stored server-side and later executes in the browser session of any administrator who views the page.

Affected versions:

ScadaBR 0.9.1 and earlier (Linux)
ScadaBR 1.12.4 Build and earlier (Windows)

CVSS v3 score: 5.4 (Medium) — network attack vector, low attack complexity, but requiring low privileges and user interaction.

The flaw was first recorded in NVD on June 11, 2021, with a proof-of-concept published on GitHub (advisory GHSA-6pvv-xrf9-29m6). CISA's November 2025 KEV addition cites evidence of active exploitation, based on proof-of-concept demonstrations and incident evidence.

Attack Scenario

1. An attacker with authenticated access (or via weak credentials on an internet-exposed instance) opens system_settings.shtm. 2. Malicious JavaScript is injected into fields such as the system name or log path, e.g., a payload that exfiltrates cookies to an attacker-controlled server. 3. When an administrator next loads the settings page, the script executes in their session context, enabling:

Session hijacking — stealing session cookies to impersonate the admin and modify PLC logic remotely
Credential theft — keylogging or harvesting reused passwords
Configuration tampering — falsifying HMI data to mislead operators (e.g., displaying false tank levels), with potential physical consequences

Because it is stored XSS, the payload persists and triggers repeatedly. In OT environments, where HMI web interfaces bridge IT and control networks, such a flaw can serve as an entry point for lateral movement toward PLCs.

Recent KEV Additions (Oct 20 – Nov 28, 2025)

| CVE ID | Vendor/Product | Date Added | Due Date | |---|---|---|---| | CVE-2021-26829 | OpenPLC ScadaBR | 2025-11-28 | 2025-12-19 | | CVE-2025-61757 | Oracle Fusion Middleware | 2025-11-21 | 2025-12-12 | | CVE-2025-13223 | Google Chromium V8 | 2025-11-19 | 2025-12-10 | | CVE-2025-58034 | Fortinet FortiWeb | 2025-11-18 | 2025-11-25 | | CVE-2025-64446 | Fortinet FortiWeb | 2025-11-14 | 2025-11-21 | | CVE-2025-9242 | WatchGuard Firebox | 2025-11-12 | 2025-12-03 | | CVE-2025-62215 | Microsoft Windows | 2025-11-12 | 2025-12-03 | | CVE-2025-12480 | Gladinet Triofox | 2025-11-12 | 2025-12-03 | | CVE-2025-21042 | Samsung Mobile Devices | 2025-11-10 | 2025-12-01 | | CVE-2025-11371 | Gladinet CentreStack and Triofox | 2025-11-04 | 2025-11-25 | | CVE-2025-48703 | CWP Control Web Panel | 2025-11-04 | 2025-11-25 | | CVE-2025-24893 | XWiki Platform | 2025-10-30 | 2025-11-20 | | CVE-2025-41244 | Broadcom VMware Aria Operations and Tools | 2025-10-30 | 2025-11-20 | | CVE-2025-59287 | Microsoft Windows | 2025-10-24 | 2025-11-14 | | CVE-2025-33073 | Microsoft Windows | 2025-10-20 | 2025-11-10 |

CVE-2021-26829 stands out as the oldest entry in this window, underscoring that legacy OT systems are a persistent soft spot for attackers.

Mitigation Guidance

1. Patch or migrate: Fixed versions are available via the Scada-LTS project (the successor to ScadaBR) on GitHub. If patching is not feasible, migrate to modern SCADA platforms. 2. Network isolation: Segment OT networks with firewalls; restrict HMI access to internal networks only. 3. WAF deployment: Use a web application firewall (e.g., ModSecurity) to block XSS payloads. 4. Monitoring: Deploy SIEM tooling to alert on anomalous browser/JavaScript activity; log access to system_settings.shtm. 5. Hardening: Enforce two-factor authentication, conduct periodic vulnerability scans (focusing on CWE-79), and run incident-response drills.

Under CISA Binding Operational Directive 22-01, federal agencies must remediate by December 19, 2025.

Key Takeaway

A moderate-severity, four-year-old XSS flaw in a legacy SCADA system can become a serious industrial risk once exploited in the wild. Organizations running OpenPLC ScadaBR should treat this as urgent: patch, isolate, and monitor — before a forgotten scar tears open.

References

1. CISA Adds One Known Exploited Vulnerability to Catalog — CISA, 2025 2. Known Exploited Vulnerabilities Catalog — CISA 3. NVD - CVE-2021-26829 — NIST 4. CVE-2021-26829: OpenPLC ScadaBR XSS Vulnerability — Cybersecurity News 5. GitHub Advisory: GHSA-6pvv-xrf9-29m6