CVE-2021-26828: OpenPLC ScadaBR -- Unrestricted File Upload RCE

Background

ScadaBR is an open-source SCADA (Supervisory Control and Data Acquisition) platform used in industrial control environments including utilities, manufacturing, and building automation. As an operational technology (OT) platform exposed to network access, vulnerabilities in ScadaBR carry significant physical-world risk beyond typical IT security concerns.

CVE-2021-26828 was originally disclosed in 2021 and received renewed attention when CISA added it to the Known Exploited Vulnerabilities catalog on 2025-12-03. This re-emergence indicates threat actors are actively targeting legacy ICS/SCADA deployments, many of which run outdated software versions without regular patch cycles.

The KEV listing is a strong signal that attackers are targeting industrial environments. ICS platforms are attractive targets for ransomware operators seeking operational disruption leverage, as well as nation-state actors conducting infrastructure reconnaissance.

Technical Mechanism

The vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) exists in the view_edit.shtm endpoint of ScadaBR’s web interface. The application fails to validate file types during the upload process, allowing an authenticated attacker to upload arbitrary JSP files to a web-accessible directory and execute them as server-side code.

// Vulnerable pattern: no content-type or extension validation
@RequestMapping(value = "/view_edit.shtm", method = RequestMethod.POST)
public String handleUpload(@RequestParam("file") MultipartFile file,
                           HttpServletRequest request) {
    String filename = file.getOriginalFilename(); // user-controlled
    File dest = new File(UPLOAD_DIR + "/" + filename); // no sanitization
    file.transferTo(dest); // writes JSP directly to webroot
    return "success";
}

After uploading a malicious .jsp file, the attacker simply requests it via HTTP to trigger execution with the privileges of the web server process.

Real-World Exploitation Evidence

The CISA KEV listing confirms active exploitation. ICS/SCADA systems are high-value targets for both cybercriminal groups seeking ransom leverage and nation-state actors. The post-authentication requirement lowers the barrier only slightly — default or weak credentials are common in ICS environments, and many deployments rely on shared credentials across sites. Once code execution is achieved, attackers can pivot to the OT network, interfere with PLC logic, or establish persistent access.

Impact Assessment

• Remote code execution on the ScadaBR server with web application privileges
• Potential pivot to OT network and connected PLCs or field devices
• Data exfiltration from SCADA historian and real-time process data
• Operational disruption via manipulation of industrial process views
• Ransomware deployment in IT/OT bridged environments

Affected Versions

Remediation Steps

1. Apply available vendor patches or migrate to a maintained ScadaBR fork.
2. Enforce network segmentation — SCADA web interfaces should not be internet-accessible.
3. Implement strong, unique credentials; disable default accounts.
4. Restrict file upload functionality to authorized administrators via network ACLs.
5. Deploy a WAF to block JSP/script file uploads at the perimeter.
6. Conduct a review of existing uploaded files for malicious content.

Detection Guidance

Log Sources: Web server access logs, file system integrity monitoring, IDS/IPS logs.

IOCs: POST requests to /view_edit.shtm with .jsp, .jspx, or .war file extensions in the body.

Suricata rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"ET WEB_SPECIFIC ScadaBR Malicious JSP Upload CVE-2021-26828";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"/view_edit.shtm"; http_uri;
  content:".jsp"; http_client_body;
  classtype:web-application-attack;
  sid:2099001; rev:1;
)

Timeline

References

• NVD — CVE-2021-26828
• CISA KEV — CVE-2021-26828
• MITRE CVE — CVE-2021-26828