ScadaBR CVE-2021-26829/26828: 2021 HMI Bugs Join KEV
These are old, authenticated web bugs, but attackers are using them against internet-facing SCADA HMIs with default passwords; find any ScadaBR you run, take it off the internet and fix its credentials.
Must act: Anyone running ScadaBR or an OpenPLC-bundled ScadaBR HMI (through 0.9.1 on Linux or 1.12.4 on Windows), especially if its web interface is reachable from the internet or still uses default credentials.
Can relax: Organizations with no ScadaBR, Scada-LTS or OpenPLC HMI deployments, and those whose HMIs sit behind a VPN on a segmented OT network with unique credentials.
- Inventory every ScadaBR, Scada-LTS and OpenPLC HMI and note its version and whether its web port is internet-reachable.
- Remove direct internet exposure: put the HMI behind a VPN or an IP allow-list on a segmented OT network.
- Change the default admin/admin login, delete unknown accounts and require unique passwords for every HMI user.