erroneo.us
Search all guides⌘K

Security Digest · Jun 11, 2021 · Vulnerability · Other

ScadaBR CVE-2021-26829/26828: 2021 HMI Bugs Join KEV

Stored XSS and JSP upload bugs in ScadaBR HMIs, disclosed in 2021, were used against Forescout ICS honeypots in 2025. Find and isolate exposed ScadaBR.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

These are old, authenticated web bugs, but attackers are using them against internet-facing SCADA HMIs with default passwords; find any ScadaBR you run, take it off the internet and fix its credentials.

Who must act: Anyone running ScadaBR or an OpenPLC-bundled ScadaBR HMI (through 0.9.1 on Linux or 1.12.4 on Windows), especially if its web interface is reachable from the internet or still uses default credentials.

Who can relax: Organizations with no ScadaBR, Scada-LTS or OpenPLC HMI deployments, and those whose HMIs sit behind a VPN on a segmented OT network with unique credentials.

Affected
OpenPLC ScadaBR through 0.9.1 on Linux (CVE record)
OpenPLC ScadaBR through 1.12.4 on Windows (CVE record)
Fixed in
No fixed ScadaBR version is named in the CVE records
Scada-LTS fork: CVE-2021-26828 upload filtering merged April 27, 2022
Scada-LTS fork: CVE-2021-26829 system-settings mitigation merged October 31, 2025
CVSS
8.8 (v3.1, CISA-ADP)
EPSS
48.0% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory every ScadaBR, Scada-LTS and OpenPLC HMI and note its version and whether its web port is internet-reachable.
  2. Remove direct internet exposure: put the HMI behind a VPN or an IP allow-list on a segmented OT network.
  3. Change the default admin/admin login, delete unknown accounts and require unique passwords for every HMI user.
  4. Where you can, migrate to a maintained build such as a current Scada-LTS release that carries the upload filtering and settings fixes.
  5. Review the system settings page and the login page text for injected script, and restore logging and alarms if they were turned off.

How to check if you are affected or compromised

  • Look for unknown HMI user accounts (Forescout's honeypot attacker created one named BARLATI) and logins with admin/admin from outside your network.
  • Search the web application directories for unexpected .jsp files and the access logs for POST requests to view_edit.shtm.
  • Check system_settings.shtm and the login page description for script tags, and confirm logging and alarms are still enabled.
  • Compare HMI and firewall logs against Forescout's indicators, including 45.157.234.199, 45.14.247.87 and 77.91.122.234.

What happened#

ScadaBR is an open-source, Java-based SCADA and HMI web application, also distributed alongside the OpenPLC project. Two of its bugs were published in June 2021. CVE-2021-26829 is a stored cross-site scripting flaw in system_settings.shtm. CVE-2021-26828 lets a logged-in user upload and run arbitrary JSP files through view_edit.shtm, which means code execution on the server. CISA's enrichment scores them CVSS 3.1 5.4 and 8.8. Both need a login. On many exposed HMIs, though, that login is still the default.

The reason they reached the KEV catalog in late 2025 is a Forescout report published October 9, 2025. It describes attacks on Forescout's ICS honeypots. In September 2025 the pro-Russian hacktivist group TwoNet logged into a decoy water-treatment HMI as admin/admin and created a user called BARLATI. The group then used CVE-2021-26829 to put a script alert reading "HACKED BY BARLATI" into the login page. It also deleted PLC data sources, changed setpoints and disabled logs and alarms. TwoNet then claimed on Telegram that it had hit a real utility. In separate activity on March 1-3, an attacker using Moldovan hosting exploited CVE-2021-26828 to upload a Java webshell, in a way that matches a public proof of concept. A second address then spent more than four hours changing HMI settings and alarms.

CISA added CVE-2021-26829 to KEV on November 28, 2025 and CVE-2021-26828 to KEV on December 3. CISA did not publish its evidence. SecurityWeek found no other public reports of in-the-wild exploitation beyond Forescout's.

Who is affected#

The CVE records list ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows, and they name no fixed version. Upstream ScadaBR's last GitHub release is 1.2, from September 2021. The Scada-LTS fork, which CISA's KEV notes point to, merged upload filtering for CVE-2021-26828 in April 2022. It merged a system-settings mitigation for CVE-2021-26829 in October 2025, after a user asked whether any ScadaBR release addressed it.

Do you really need to act?#

Only if you run ScadaBR, but that group is the one these attacks target: small utilities, labs, integrators and hobby installations whose HMI is on the internet with default credentials. Neither bug helps an attacker who cannot log in. Default passwords supply that login, and from there CVE-2021-26828 gives code execution on the HMI host. Because there is no clearly patched ScadaBR release to install, the realistic fix is to isolate the HMI, change its credentials, and plan to move to a maintained build.

What to do now#

  1. Find every ScadaBR, Scada-LTS or OpenPLC HMI. From outside your network, check whether its web port (often Tomcat on 8080) answers, for example nmap -p 80,8080,443 <range> and a request to /ScadaBR/login.htm.
  2. Take internet-facing HMIs off the internet. Put them behind a VPN or an IP allow-list on a segmented OT network.
  3. Replace admin/admin and other default logins, remove unknown users, and give every operator a unique account.
  4. Plan a migration to a maintained build that carries both Scada-LTS fixes, and test it before you rely on it.

How to tell if you were hit#

Review HMI users for accounts you did not create. Look at the login page description and system settings for <script> content, and confirm that logging and alarms are still on. Search the Tomcat web application directory for unexpected JSP files, for example find /opt/tomcat*/webapps -name '*.jsp' -newer <install-marker>. Check access logs for POST requests to view_edit.shtm. Compare logs with Forescout's indicators: 45.157.234.199 (TwoNet's login), 45.14.247.87 and 77.91.122.234. Check PLC setpoints and data-source configuration against known-good values.

Timeline#

  • — Both CVEs are published.
  • — Scada-LTS merges upload filtering for CVE-2021-26828.
  • — Forescout publishes its report on exploitation of its honeypots.
  • — Scada-LTS merges a mitigation for CVE-2021-26829.
  • — CISA adds CVE-2021-26829 to KEV, with a December 19 deadline.
  • — CISA adds CVE-2021-26828 to KEV, with a December 24 deadline.

Vulnerability records

  • CVE-2021-26829 · KEV 2025-11-28 · OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
  • CVE-2021-26828 · KEV 2025-12-03 · OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CVE record — CVE-2021-26829 cve.org
  2. CVE record — CVE-2021-26828 cve.org
  3. NVD — CVE-2021-26829 nvd.nist.gov
  4. NVD — CVE-2021-26828 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2021-26829 cisa.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2021-26828 cisa.gov
  7. Scada-LTS — PR 2174: Fixed import project CVE-2021-26828 github.com
  8. Scada-LTS — PR 3211: CVE-2021-26829 Mitigation Guidance [System settings] github.com
  9. ScadaBR — GitHub releases github.com
  10. Forescout — Anatomy of a hacktivist attack: Russian-aligned group targets OT/ICS forescout.com

Coverage and analysis

  1. SecurityWeek — CISA warns of ScadaBR vulnerability after hacktivist ICS attack securityweek.com