OpenPLC ScadaBR Cross-site Scripting (CVE-2021-26829)

Historical catalog analysis: CISA added this entry on November 28, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-26829 is a cross-site scripting (XSS) vulnerability identified in OpenPLC ScadaBR. The flaw exists within the system_settings.shtm component, where insufficient input validation or output encoding could allow for the execution of malicious scripts in the context of a user’s browser session.

Exposure and applicability

This vulnerability affects infrastructure owners and operators utilizing OpenPLC ScadaBR. Because this software is often used in industrial control environments to monitor and manage SCADA systems, exposure exists wherever the system_settings.shtm page is accessible to users. The source indicates that this may affect open-source components or third-party implementations that incorporate the vulnerable code.

Remediation priorities

Based on our analysis of the available data, vulnerability management teams should prioritize the following actions:

1. Identify Affected Assets: Locate all instances of OpenPLC ScadaBR within the environment and verify if the system_settings.shtm component is active.
2. Apply Code-Level Fixes: The source points to GitHub pull request 3211 (SCADA-LTS/Scada-LTS) as the technical remediation path. Defenders should evaluate this PR to determine if the fix can be integrated into their specific deployment.
3. Restrict Administrative Access: As a compensating control, limit access to system settings pages to trusted internal networks or authenticated administrators to reduce the likelihood of an external actor triggering the XSS flaw.
4. Evaluate Product Viability: In cases where mitigations cannot be applied or verified, organizations should consider discontinuing use of the product as suggested by CISA guidance.

How to validate remediation

To verify that exposure has been reduced, defenders should move beyond simple version checks:

• Patch Verification: Confirm that the specific changes introduced in GitHub PR 3211 have been merged and deployed to the production environment.
• Functional Testing: In a non-production environment, security teams can attempt to input script tags into the system_settings.shtm fields to verify if the application now properly sanitizes or encodes the output.

Verification is complete when it is demonstrated that the specific entry point in system_settings.shtm no longer executes arbitrary scripts.

Limits and open questions

There are several unknowns regarding this vulnerability. The source does not specify which exact versions of OpenPLC ScadaBR are affected, requiring defenders to manually check their implementation against the provided GitHub PR. Additionally, while CISA has added this to the Known Exploited Vulnerabilities catalog, it remains unknown if this flaw is being utilized in ransomware campaigns. Residual risk remains for organizations using proprietary forks of the software where the upstream fix from SCADA-LTS may not have been ported.

Source and editorial note

CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability · Source date: November 28, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 01, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 27, 2026 at 00:40 UTC.

Request a Vulnerability Assessment