Detections
Analytics

CVE-2021-26828

high

Description

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

References

https://securityaffairs.com/185327/hacking/u-s-cisa-adds-new-openplc-scadabr-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2025/12/03/cisa-adds-one-known-exploited-vulnerability-catalog

https://github.com/h002733/CVE-2021-26828

https://github.com/Yuri08loveElaina/CVE-2021-26828

https://youtu.be/k1teIStQr1A

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828

https://github.com/SCADA-LTS/Scada-LTS/pull/2174

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-13613

http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html

http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4

Details

Source: Mitre, NVD

Published: 2021-06-11

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.39096