CVE-2021-26829: Stored XSS in OpenPLC ScadaBR Added to CISA KEV Catalog
This post discusses CVE-2021-26829, a stored cross-site scripting (XSS) vulnerability in OpenPLC ScadaBR that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on November 28, 2025.
Key points
- The vulnerability: CVE-2021-26829 is a stored XSS flaw (CWE-79, improper input neutralization during web page generation) in the
system_settings.shtmcomponent of OpenPLC ScadaBR, an open-source HMI/SCADA platform derived from Mango Automation. - Attack requirements: Only a low-privileged account is needed. Injected JavaScript persists and executes when an administrator or operator views the system settings page, enabling session cookie theft, credential phishing via fake login prompts, and display manipulation.
- Severity: CVSS v3.1 score of 5.4 (medium); network attack vector, low complexity, low privileges required, user interaction needed.
- CISA KEV addition (November 28, 2025): Exploitation confirmed as active in the wild. Association with specific campaigns (e.g., ransomware) is listed as unknown. US federal civilian agencies must patch by December 19, 2025 under BOD 22-01; non-federal organizations are strongly urged to follow.
- Exploitation evidence: OT honeypots have captured automated XSS payloads targeting ScadaBR endpoints, such as script injection variants aimed at
/system_settings.shtm. Threat actors view it as a low-barrier initial access vector that can pivot from HMI to PLC environments. - Why old flaws resurface: Many deployments remain on legacy versions (ScadaBR 0.9.1 on Linux, 1.12.4 on Windows), and automated scanners readily find exposed instances.
Impact in industrial control systems
| Impact | Description | Likelihood in ICS | Mitigation priority | |---|---|---|---| | Confidentiality | Theft of operator credentials or sensitive process data via script execution | Medium | High – enable MFA on HMI logins | | Integrity | Manipulated display data leading to incorrect control decisions | High | High – input validation and output encoding in forks | | Availability | Browser DoS via resource-heavy scripts | Low | Medium – network segmentation of HMIs | | Overall OT risk | Pivot from HMI to PLC for ransomware or sabotage | Medium-high | Critical – patch per KEV guidance and monitor |
Mitigation guidance
1. Assess: Inventory ScadaBR instances using Nessus, OpenVAS, or asset databases; identify exposed systems.
2. Patch: Deploy the fix from Scada-LTS pull request #3211, which adds escaping to system_settings.shtm. Test in non-production first (Docker or WAR deployment available on GitHub).
3. Defend: Restrict HMI network access, deploy a WAF to block XSS payloads, and enforce a Content Security Policy, e.g. Content-Security-Policy: script-src 'self';. Use VPNs or zero-trust access models.
4. Monitor: Configure SIEM rules for anomalous HTTP requests to /system_settings.shtm; integrate CISA Automated Indicator Sharing (AIS) for emerging IoCs.
5. Migrate: Consider moving legacy deployments to supported alternatives such as Ignition or WinCC, or actively maintained community forks like Scada-LTS.
Takeaway
The KEV addition highlights a recurring pattern in open-source OT tooling: dormant web vulnerabilities in forgotten HMI software can be revived by mature attacker tooling. Integrating KEV checks into vulnerability management workflows (aligned with NIST SP 800-53 and MITRE ATT&CK for ICS) and patching promptly are the most effective defenses.
References
1. CISA KEV Catalog 2. CISA Alert: KEV Addition, November 28, 2025 3. NVD: CVE-2021-26829 4. Cybersecurity News: CISA Warns of OpenPLC ScadaBR XSS Exploitation 5. Windows Forum: CISA KEV Addition Analysis