CVE-2021-26829

OpenPLC ScadaBR, an open-source SCADA/HMI web application, contains a cross-site scripting flaw (CWE-79) in its system_settings.shtm settings page. An attacker can trigger it by getting a user's browser to load system_settings.shtm with malicious script injected into the request, which the application then renders without adequate sanitization. Successful exploitation executes attacker-supplied script in the victim's browser session, potentially hijacking the authenticated web session and performing actions such as changing settings or views as that user. Any organization running the OpenPLC ScadaBR web interface is affected, especially instances reachable from the internet or by untrusted users. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-11-28, indicating exploitation in the wild, and EPSS assigns a 48% probability of exploitation within 30 days (99th percentile); no public proof-of-concept is known and no CVSS score has been published.

What to do: Apply mitigations per vendor instructions and update ScadaBR/OpenPLC to the latest available build, since the advisory does not specify a fixed version; federal agencies must meet the BOD 22-01 deadline or discontinue use if mitigations are unavailable. Restrict network access to the ScadaBR web interface so it is not directly internet-exposed, and review web-server logs for suspicious or script-bearing requests to system_settings.shtm. Prioritize patching on internet-facing instances given the KEV listing and elevated EPSS score.