CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2021-26828 is an unrestricted file upload vulnerability in OpenPLC ScadaBR. It lets a remote authenticated user upload and execute arbitrary JSP files through the view_edit.shtm interface. In industrial and SCADA environments this can give an attacker a foothold to run code on the host, so teams that still run the product should treat it as a priority for inventory and remediation.

Public detail is limited to the CISA description of the flaw; exact version ranges, CVSS scores and patch identifiers must be confirmed against the vendor advisory before any decision is made.

How it works

The weakness is CWE-434: unrestricted upload of a file with a dangerous type. In this case the application accepts a JSP file through the view_edit.shtm page and later allows that file to be executed. Because the upload is performed by an already-authenticated user, the attacker does not need to break authentication first; once the JSP is on the server it can be invoked to run arbitrary code under the privileges of the web application process.

No further exploit mechanics, payload formats or privilege-escalation paths are supplied in the public record. Defenders should therefore treat any successful authenticated upload of a JSP (or similar server-side script) as a potential indicator of compromise and should verify the precise attack surface against the vendor advisory.

Am I affected? How to find it in your systems

OpenPLC ScadaBR is typically deployed as a web-based SCADA or PLC programming interface on industrial control networks, engineering workstations or dedicated servers that manage process automation. Look for installations by:

• Searching asset inventories, CMDB records and software-deployment tools for the product name “OpenPLC ScadaBR” or related OpenPLC packages.
• Scanning internal web servers for the presence of the view_edit.shtm endpoint or other ScadaBR-specific paths.
• Reviewing package managers, container images and virtual-machine templates that may contain the application.

Because exact vulnerable version numbers are not listed in the supplied facts, compare every discovered instance against the vendor’s advisory to determine whether it is affected. Configuration that permits authenticated users to reach the upload functionality should be treated as in-scope until proven otherwise.

Telemetry that may indicate exploitation includes web-server access logs showing POST requests to view_edit.shtm that result in the creation of new .jsp files, subsequent requests that execute those files, or unexpected process creation under the application’s service account. Correlate these events with authentication logs to identify the responsible user account.

How to remediate

The primary action is to apply the vendor-supplied update or mitigation instructions for OpenPLC ScadaBR. CISA’s required action is to follow those vendor instructions, apply any applicable BOD 22-01 guidance if the product is offered as a cloud service, or discontinue use of the product if mitigations are unavailable.

After patching, harden the remaining surface for this class of flaw:

• Restrict the set of authenticated users who can reach the upload interface to the absolute minimum required for operations.
• Enforce strict file-type and content validation on any remaining upload paths; reject JSP and other executable extensions by default.
• Run the web application under a least-privilege service account and place it behind a reverse proxy that can strip or quarantine unexpected file types.
• Ensure the application and its host receive regular security updates and that the host is isolated from general-purpose enterprise networks.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation: place the ScadaBR host on a tightly controlled OT or management VLAN; block inbound access from corporate or internet zones except for explicitly authorized jump hosts.
• Virtual patching / WAF: if a web-application firewall is available, create a rule that blocks uploads of JSP (and other server-side script) files to view_edit.shtm and similar endpoints.
• Feature disablement: if operationally feasible, disable or remove the view_edit.shtm functionality or the entire upload capability until a patched version is installed.
• Heightened monitoring: alert on any file-write activity under the web root, on execution of newly created JSP files, and on anomalous authentication events. Retain logs long enough for forensic review.

If none of these mitigations can be implemented, CISA guidance is to discontinue use of the product.

If your data may have been exposed

Actively exploited vulnerabilities of this type frequently lead to full system compromise and subsequent data theft or ransomware. Known ransomware use of CVE-2021-26828 is not documented, but any confirmed exploitation should still be treated as a potential breach. Review authentication and file-system logs for evidence of unauthorized JSP uploads, rotate credentials for all accounts that had access to the system, and examine downstream systems that the compromised host could reach. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether any related credentials have already appeared in public dumps.