Arbitrary File Upload Vulnerability in OpenPLC ScadaBR

Historical catalog analysis: CISA added this entry on December 03, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-26828 is an unrestricted upload of file with dangerous type vulnerability (CWE-434) identified in OpenPLC ScadaBR. The flaw allows a remote user who has already been authenticated to the system to upload and execute arbitrary JavaServer Pages (JSP) files via the view_edit.shtm interface.

Exposure and applicability

This vulnerability specifically affects environments utilizing OpenPLC ScadaBR for industrial visualization and control. Because this software is often used as a central hub for monitoring PLCs and managing process data, an attacker with valid credentials could leverage this flaw to execute code on the server hosting the SCADA application.

Asset owners should note that since this may involve open-source components or third-party libraries, the vulnerability might be present in various implementations of the software across different industrial platforms.

Remediation priorities

Based on our analysis of the reported flaw, we recommend the following prioritized actions for OT security leaders and controls engineers:

1. Apply Vendor Mitigations: The primary priority is to implement mitigations as specified by the vendor instructions. This is the most direct method to address the underlying file upload mechanism.
2. Review Access Controls: Because this vulnerability requires authentication, auditing and restricting user accounts with access to the view_edit.shtm functionality could reduce the likelihood of exploitation by unauthorized or low-privileged users.
3. Evaluate Product Viability: In cases where vendor mitigations are unavailable or cannot be applied due to operational constraints, asset owners should evaluate whether to discontinue use of the product to eliminate the risk.
4. Network Segmentation: While not a fix for the vulnerability itself, ensuring the SCADA server is isolated from the corporate network and the public internet can limit the paths available for remote authenticated access.

How to validate remediation

To verify that exposure has been reduced, operators should follow these steps under a formal change control process:
* Version Verification: Confirm that the applied version or patch matches the vendor’s recommended secure release.
* Configuration Audit: Verify that the specific interface (view_edit.shtm) is either patched or restricted to only the most essential personnel.
* Authorized Testing: In a non-production environment, security personnel can attempt to upload a non-malicious file of a dangerous type (such as a JSP file) using an authenticated account to confirm that the system now rejects such uploads.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in active ransomware campaigns. Additionally, because ScadaBR may be integrated into various proprietary implementations or third-party products, asset owners must verify with their specific equipment integrators if their version of the software is affected. A version check alone does not guarantee security, as custom configurations or bundled libraries may introduce different risk profiles.

Source and editorial note

CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability · Source date: December 03, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 06, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 11, 2026 at 01:48 UTC.

Request an OT security assessment