CVE-2021-26829: OpenPLC ScadaBR stored XSS via system_settings.shtm

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a medium-CVSS stored XSS in an ICS product, but CISA KEV listing, a high EPSS score and public exploit references raise the operational urgency.

What it is

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored cross-site scripting through system_settings.shtm. Because the injected script persists in the application and is served to other users, it can compromise operator sessions in an industrial control environment.

Impact

An attacker can execute arbitrary script in the browser of a user who views the affected settings page, potentially stealing session cookies or performing actions as that user. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network via the system_settings.shtm page; the CVSS vector requires low privileges (PR:L) and user interaction (UI:R), so an authenticated low-privileged user must lure or cause a victim to view the stored payload.

Exploitation

CVE-2021-26829 is listed in CISA KEV with a due date of 2025-12-19, and EPSS gives a 30-day probability of 0.4805 (98.8th percentile); references include an Exploit-tagged third-party advisory, indicating public exploit material exists.

What to do

• Apply the vendor's patched ScadaBR release or documented mitigation from the ScadaBR forum advisory; if no fix is available, follow CISA guidance to discontinue use.
• Restrict access to system_settings.shtm and the ScadaBR administrative interface to trusted networks and authorized roles only.
• Enforce output encoding and input sanitization for stored settings fields, and deploy a web application firewall rule to block script payloads targeting that page.
• Reduce the impact of session theft by using short session lifetimes, HttpOnly and Secure cookie flags, and re-authentication for sensitive actions.

Detection

• Inspect ScadaBR web logs for requests to system_settings.shtm containing script tags, event handlers, or encoded HTML in submitted parameters.
• Monitor for anomalous or unexpected script content stored in ScadaBR configuration/settings data and for outbound browser requests to unfamiliar domains from operator workstations.
• Alert on repeated access to system_settings.shtm by low-privileged accounts or from unusual source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.