Risk Letters

Exploited vulnerability

CVE-2021-26828

TLP:CLEAR

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Facts

  • Vendor: OpenPLC
  • Product: ScadaBR
  • CVSS: 8.8
  • EPSS (probability of exploitation within 30 days): 39.1 %
  • On CISA's Known Exploited Vulnerabilities list since: 3 December 2025
  • First known exploitation: 3 December 2025
  • CISA's deadline for US federal agencies: 24 December 2025
  • Weakness: CWE-434
  • First seen by Risk Letters: 3 December 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD