CVE-2021-26828: OpenPLC ScadaBR unrestricted JSP file upload leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit, KEV listing and high EPSS, though it requires an authenticated account.

What it is

OpenPLC ScadaBR (through 0.9.1 on Linux and 1.12.4 on Windows) fails to restrict uploaded file types, letting an authenticated user upload and execute arbitrary JSP files through view_edit.shtm. Because the uploaded JSP runs on the server, this turns a normal user account into remote code execution on the SCADA host.

Impact

An attacker with a valid low-privilege account gains remote code execution as the web application's server process, allowing full compromise of the ScadaBR host and any connected control-system data or interfaces.

Attack surface

Reached over the network via the view_edit.shtm upload endpoint; the CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates no user interaction is needed but a valid authenticated account is required.

Exploitation

CVE-2021-26828 is listed in CISA KEV (added 2025-12-03) and has a high EPSS 30-day probability of 0.39356 (98.5th percentile); multiple references are tagged Exploit, including Packet Storm and a YouTube demonstration.

What to do

• Apply the vendor patch referenced in the Scada-LTS pull request and upgrade ScadaBR to a fixed release; if no fix is available for your version, follow CISA guidance and discontinue use.
• Restrict upload functionality and validate file types server-side, blocking JSP and other executable extensions in the upload path.
• Limit ScadaBR access to trusted networks and remove or disable unnecessary accounts, since exploitation requires authentication.
• Run the ScadaBR web service with least privilege and isolate it from sensitive control networks.
• Monitor CISA KEV remediation deadlines (due 2025-12-24) and confirm patched status.

Detection

• Monitor web server and ScadaBR logs for POST requests to view_edit.shtm followed by access to newly written .jsp files.
• Alert on creation of JSP files in web-accessible upload or application directories.
• Watch for unexpected child processes spawned by the Java/web server process, indicating uploaded JSP execution.
• Correlate authentication events with subsequent file uploads from the same account or source IP.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.