CVE-2021-26829: Stored XSS in OpenPLC ScadaBR Added to CISA KEV Catalog

Forum topic · ✨步子哥 · 2025-11-30

Summary

CVE-2021-26829 is a stored cross-site scripting (XSS) vulnerability (CWE-79) in the system_settings.shtm component of OpenPLC ScadaBR, an open-source HMI used to monitor PLCs. With a CVSS v3.1 score of 5.4, a low-privilege attacker can inject malicious JavaScript into system settings; the payload persists and executes when an administrator views the page, enabling session cookie theft, credential phishing, and fake content display. On November 28, 2025, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, citing confirmed active exploitation in the wild, with federal agencies required to patch by December 19, 2025 under BOD 22-01. OT honeypots have captured automated XSS payloads targeting ScadaBR endpoints. Risks include credential theft, manipulated display data causing wrong control decisions, and pivoting from HMI to PLC attacks. The fix is available in Scada-LTS pull request #3211, which adds output escaping; defenders should also apply network segmentation, WAF rules, a Content-Security-Policy header, and SIEM monitoring.

CVE-2021-26829, a stored cross-site scripting (XSS) vulnerability in OpenPLC ScadaBR, resurfaced in 2025 after being added to CISA's Known Exploited Vulnerabilities (KEV) catalog on November 28, 2025. This article explains the vulnerability, its exploitation status, industrial impact, and mitigation steps.

Vulnerability Overview

Discovered in 2021, CVE-2021-26829 is a stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the system_settings.shtm component of ScadaBR, an open-source HMI derived from Mango Automation for monitoring and controlling PLCs. Input validation is effectively absent: an attacker with only a low-privilege account can inject malicious JavaScript into system settings. The payload persists like a time bomb and executes when an administrator or operator opens the page, enabling session cookie theft, fake login prompts, and forged content.

CVSS v3.1 score: 5.4 (Medium) — network vector, low complexity, low privileges required, user interaction required
Affected versions: ScadaBR 0.9.1 (Linux) and 1.12.4 (Windows) are commonly still deployed
Fix: Scada-LTS pull request #3211 adds an escaping mechanism to system_settings.shtm

Stored XSS is particularly insidious because malicious code is saved server-side and triggers on later visits. In ICS environments, HMIs bridge IT and OT networks, so a web-level flaw can become a stepping stone toward PLC-level access.

CISA KEV Addition

On November 28, 2025, CISA added CVE-2021-26829 to the KEV catalog with exploitation status "Known Exploited" and known ransomware association listed as "Unknown." Federal Civilian Executive Branch agencies must remediate by December 19, 2025 under Binding Operational Directive (BOD) 22-01; non-federal organizations are strongly urged to follow suit.

| KEV Fact | Detail | Impact | |---|---|---| | Date added | November 28, 2025 | Federal deadline: December 19, 2025 | | Exploitation status | Confirmed active in the wild | Suggests honeypot/incident response intelligence | | Related activity | Unknown | Guard against chained attacks (XSS + privilege escalation) | | Fix reference | Scada-LTS PR #3211 & NVD | Patch via GitHub, test before deployment |

Exploitation in the Wild

After a 2021 proof-of-concept became public, the flaw transitioned from academic curiosity to attacker tooling. In 2025, OT honeypots captured automated XSS payload attempts against ScadaBR endpoints targeting /system_settings.shtm, and underground discussions tout it as low-barrier initial access for ICS intrusions. Attackers view it as a persistence and credential-theft vector enabling lateral movement toward PLCs. While no major public breach has been attributed to it, the KEV listing implies CISA holds corroborating intelligence.

Industrial Impact

Confidentiality (Medium likelihood): Script execution can steal operator credentials and sensitive process data. Mitigate with MFA on HMI logins.
Integrity (High likelihood): Manipulated display data can lead to wrong control decisions. Mitigate with input validation and output encoding.
Availability (Low likelihood): DoS-style scripts can exhaust browser resources. Mitigate with network segmentation.
Overall OT risk (Medium-High): Potential pivot from HMI to PLC for ransomware or sabotage.

Relevant sectors include manufacturing, energy, and water treatment, where ScadaBR's low cost makes it popular.

Mitigation Blueprint

1. Assess: Inventory and scan ScadaBR instances (e.g., Nessus/OpenVAS); flag exposed instances. 2. Patch: Deploy Scada-LTS PR #3211 (Docker or WAR), with compatibility testing in a non-production environment. 3. Defend: Restrict HMI network access, deploy a WAF to block XSS payloads, and enable a Content-Security-Policy header such as Content-Security-Policy: script-src 'self';. 4. Monitor: Create SIEM rules for anomalous HTTP requests to /system_settings.shtm; integrate CISA's Automated Indicator Sharing (AIS) for emerging IoCs. 5. Report & migrate: Report incidents via CISA's vulnerability report form; consider migrating legacy deployments to supported alternatives (e.g., Ignition or WinCC).

Outlook

The KEV addition highlights the "set-and-forget" trap in ICS software. Dormant flaws in open-source OT tooling will continue to resurface as attacker tooling matures. Defenders should integrate KEV checks into vulnerability management aligned with NIST SP 800-53 and MITRE ATT&CK for ICS, and share intelligence through programs like CISA Shields Up. Acting now—patch, segment, and monitor—is the path to resilience.

References

1. CISA KEV Catalog Entry for CVE-2021-26829 2. CISA Alert: Addition to KEV Catalog (November 28, 2025) 3. NVD Detail: CVE-2021-26829 4. Cybersecurity News: CISA Warns of OpenPLC ScadaBR XSS Exploitation 5. Windows Forum: CISA KEV Addition Analysis