--- title: "ScadaBR CVE-2021-26829/26828: 2021 HMI Bugs Join KEV" url: https://erroneo.us/security/briefs/scadabr-cve-2021-26829-26828-xss-jsp-upload/ description: "Stored XSS and JSP upload bugs in ScadaBR HMIs, disclosed in 2021, were used against Forescout ICS honeypots in 2025. Find and isolate exposed ScadaBR." type: security-brief section: "Security Digest" date_published: 2021-06-11 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2021-26829", "CVE-2021-26828"] severity: "high" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # ScadaBR CVE-2021-26829/26828: 2021 HMI Bugs Join KEV **Verdict: Check exposure.** These are old, authenticated web bugs, but attackers are using them against internet-facing SCADA HMIs with default passwords; find any ScadaBR you run, take it off the internet and fix its credentials. - **Who must act:** Anyone running ScadaBR or an OpenPLC-bundled ScadaBR HMI (through 0.9.1 on Linux or 1.12.4 on Windows), especially if its web interface is reachable from the internet or still uses default credentials. - **Who can relax:** Organizations with no ScadaBR, Scada-LTS or OpenPLC HMI deployments, and those whose HMIs sit behind a VPN on a segmented OT network with unique credentials. - **Affected:** OpenPLC ScadaBR through 0.9.1 on Linux (CVE record); OpenPLC ScadaBR through 1.12.4 on Windows (CVE record) - **Fixed:** No fixed ScadaBR version is named in the CVE records; Scada-LTS fork: CVE-2021-26828 upload filtering merged April 27, 2022; Scada-LTS fork: CVE-2021-26829 system-settings mitigation merged October 31, 2025 - **CVEs:** CVE-2021-26829, CVE-2021-26828 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every ScadaBR, Scada-LTS and OpenPLC HMI and note its version and whether its web port is internet-reachable. 2. Remove direct internet exposure: put the HMI behind a VPN or an IP allow-list on a segmented OT network. 3. Change the default admin/admin login, delete unknown accounts and require unique passwords for every HMI user. 4. Where you can, migrate to a maintained build such as a current Scada-LTS release that carries the upload filtering and settings fixes. 5. Review the system settings page and the login page text for injected script, and restore logging and alarms if they were turned off. ### How to check if you are affected - Look for unknown HMI user accounts (Forescout's honeypot attacker created one named BARLATI) and logins with admin/admin from outside your network. - Search the web application directories for unexpected .jsp files and the access logs for POST requests to view_edit.shtm. - Check system_settings.shtm and the login page description for script tags, and confirm logging and alarms are still enabled. - Compare HMI and firewall logs against Forescout's indicators, including 45.157.234.199, 45.14.247.87 and 77.91.122.234. ## What happened ScadaBR is an open-source, Java-based SCADA and HMI web application, also distributed alongside the OpenPLC project. Two of its bugs were published in June 2021. [CVE-2021-26829](https://www.cve.org/CVERecord?id=CVE-2021-26829) is a stored cross-site scripting flaw in `system_settings.shtm`. [CVE-2021-26828](https://www.cve.org/CVERecord?id=CVE-2021-26828) lets a logged-in user upload and run arbitrary JSP files through `view_edit.shtm`, which means code execution on the server. CISA's enrichment scores them CVSS 3.1 5.4 and 8.8. Both need a login. On many exposed HMIs, though, that login is still the default. The reason they reached the KEV catalog in late 2025 is a [Forescout report](https://www.forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/) published October 9, 2025. It describes attacks on Forescout's ICS honeypots. In September 2025 the pro-Russian hacktivist group TwoNet logged into a decoy water-treatment HMI as `admin/admin` and created a user called BARLATI. The group then used CVE-2021-26829 to put a script alert reading "HACKED BY BARLATI" into the login page. It also deleted PLC data sources, changed setpoints and disabled logs and alarms. TwoNet then claimed on Telegram that it had hit a real utility. In separate activity on March 1-3, an attacker using Moldovan hosting exploited CVE-2021-26828 to upload a Java webshell, in a way that matches a public proof of concept. A second address then spent more than four hours changing HMI settings and alarms. CISA added CVE-2021-26829 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26829) on November 28, 2025 and CVE-2021-26828 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828) on December 3. CISA did not publish its evidence. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-scadabr-vulnerability-after-hacktivist-ics-attack/) found no other public reports of in-the-wild exploitation beyond Forescout's. ## Who is affected The CVE records list ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows, and they name no fixed version. Upstream ScadaBR's [last GitHub release](https://github.com/ScadaBR/ScadaBR/releases) is 1.2, from September 2021. The Scada-LTS fork, which CISA's KEV notes point to, merged upload filtering for CVE-2021-26828 in [April 2022](https://github.com/SCADA-LTS/Scada-LTS/pull/2174). It merged a system-settings mitigation for CVE-2021-26829 in [October 2025](https://github.com/SCADA-LTS/Scada-LTS/pull/3211), after a user asked whether any ScadaBR release addressed it. ## Do you really need to act? Only if you run ScadaBR, but that group is the one these attacks target: small utilities, labs, integrators and hobby installations whose HMI is on the internet with default credentials. Neither bug helps an attacker who cannot log in. Default passwords supply that login, and from there CVE-2021-26828 gives code execution on the HMI host. Because there is no clearly patched ScadaBR release to install, the realistic fix is to isolate the HMI, change its credentials, and plan to move to a maintained build. ## What to do now 1. Find every ScadaBR, Scada-LTS or OpenPLC HMI. From outside your network, check whether its web port (often Tomcat on 8080) answers, for example `nmap -p 80,8080,443 ` and a request to `/ScadaBR/login.htm`. 2. Take internet-facing HMIs off the internet. Put them behind a VPN or an IP allow-list on a segmented OT network. 3. Replace `admin/admin` and other default logins, remove unknown users, and give every operator a unique account. 4. Plan a migration to a maintained build that carries both Scada-LTS fixes, and test it before you rely on it. ## How to tell if you were hit Review HMI users for accounts you did not create. Look at the login page description and system settings for `