5.4

CVE-2021-26829

Warnung
Exploit
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Scadabr ≫ Scadabr Version <= 0.9.1
   Linux ≫ Linux Kernel Version-
Scadabr ≫ Scadabr Version <= 1.12.4
   Microsoft ≫ Windows Version-

28.11.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

OpenPLC ScadaBR Cross-site Scripting Vulnerability

Schwachstelle

OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.

Beschreibung

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 48.05% 0.987
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4
Vendor Advisory
https://youtu.be/Xh6LPCiLMa8
Third Party Advisory
Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26829
US Government Resource
https://www.forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/
Third Party Advisory