MEDIUM
CVE-2021-26829
CVSS
5.4
KEV
Description
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Summary dbcve.org
OpenPLC ScadaBR contains a stored Cross-Site Scripting (XSS) vulnerability in the system_settings.shtm page. Attackers can inject malicious JavaScript payloads that persist on the server and execute in the browsers of users who access the affected settings page.
Mitigation
Implement proper input validation and output encoding on all user-controllable fields in system_settings.shtm. Apply context-appropriate escaping when rendering user-supplied data back to the browser.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
48.05%
Probability of exploitation in next 30 days
98.8th percentile
References
http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4
Vendor Advisory
https://youtu.be/Xh6LPCiLMa8
Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26829
US Government Resource
https://www.forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/
Third Party Advisory
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.