OpenPLC ScadaBR Cross-Site Scripting Vulnerability CVE-2021-26829

Historical catalog analysis: CISA added this entry on November 28, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-26829 is a cross-site scripting (XSS) vulnerability identified in OpenPLC ScadaBR, an open-source SCADA system. The flaw resides specifically within the system_settings.shtm component. XSS vulnerabilities typically occur when an application includes untrusted data in a web page without proper validation or encoding, potentially allowing an attacker to execute malicious scripts in the browser of a user accessing the interface.

Exposure and applicability

This vulnerability applies to operators and asset owners utilizing OpenPLC ScadaBR for industrial automation and monitoring. Because ScadaBR is open-source, this component may be integrated into various proprietary implementations or third-party libraries used across different industrial products. The primary exposure point is the system settings page of the web interface. While the source does not specify a version range, the inclusion of this CVE in the CISA Known Exploited Vulnerabilities catalog indicates that it is a known risk to environments deploying this software.

Remediation priorities

Based on our analysis, organizations should prioritize the following actions to reduce exposure:

1. Vendor Mitigation Review: Asset owners should first identify if ScadaBR is deployed within their OT environment and consult vendor instructions or the associated project repositories (such as the referenced GitHub pull request) for available patches or configuration changes.
2. Access Control Restrictions: Since XSS requires a user to interact with a compromised page, restricting access to the SCADA web interface to authorized personnel via secure VPNs or isolated management networks could reduce the likelihood of successful exploitation.
3. Product Lifecycle Evaluation: In cases where mitigations are unavailable or cannot be applied due to operational constraints, organizations should evaluate whether to discontinue use of the affected product in favor of a supported alternative.

How to validate remediation

Validation should be conducted according to site-specific change control and safety protocols. We recommend the following approach:
* Version Verification: Confirm that the deployed version of ScadaBR matches the patched version recommended by the vendor or project maintainers.
* Configuration Audit: Verify that the system_settings.shtm component is no longer accessible to unauthorized users or that input validation controls have been implemented as per vendor guidance.

Note: To ensure operational stability, any validation testing should be performed in a staging environment rather than on production control equipment.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by specific ransomware campaigns. Additionally, because ScadaBR is an open-source project often embedded in other tools, it may be unclear to some asset owners if they are running the affected component under a different product brand. The effectiveness of any mitigation depends on the specific implementation of the software within the local industrial network.

Source and editorial note

CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability · Source date: November 28, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 01, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 11, 2026 at 01:55 UTC.

Request an OT security assessment