OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

cat cve-2021-26828.json

Vendor: OpenPLC
Product: ScadaBR
CVSS: 8.8
EPSS (exploit probability): 39.4%
Status: kev
CISA patch-by (BOD 22-01): December 24, 2025
Published: December 3, 2025
Source: https://nvd.nist.gov/vuln/detail/CVE-2021-26828

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Added to CISA’s Known Exploited Vulnerabilities catalog on 2025-12-03. Required action per CISA: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due date: 2025-12-24.

This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.