Cross‑Site Scripting (CVE‑2021‑26829) in OpenPLC ScadaBR Exposes Web Interface to Script Injection
What It Is – OpenPLC ScadaBR’s web‑based configuration page (system_settings.shtm) contains an unsanitized input vector that allows an attacker to inject arbitrary JavaScript. The flaw is catalogued as CVE‑2021‑26829.
Exploitability – Publicly disclosed; proof‑of‑concept code is available on public repositories. No known active exploit campaigns, but the vulnerability can be triggered by any unauthenticated user who can reach the web UI. CVSS v3.1 base score is 6.5 (Medium).
Affected Products – OpenPLC ScadaBR (all versions prior to the vendor‑released fix in March 2022).
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in secure development and input‑validation controls – a core control objective that underpins many frameworks (e.g., NIST CSF Protect, ISO 27001 A.14).
- Without remediation, attackers can hijack user sessions, deface dashboards, or pivot to other internal systems, eroding the evidentiary trail needed for audit readiness.
- Continuous control monitoring can surface such web‑application flaws early, providing defensible proof that the organization maintains a hardened attack surface.
Recommended Actions
- Inventory all ScadaBR instances and verify version.
- Apply the vendor‑issued patch (or upgrade to the latest release).
- Conduct a focused web‑application scan to confirm the XSS vector is mitigated.
- Document remediation steps in your control evidence repository and map the fix to the “Secure Development” control objective.
- Update your secure‑coding policy to require input sanitization and periodic code review for all SCADA web interfaces.
Source: CISA KEV – CVE‑2021‑26829