U.S. CISA adds a new an OpenPLC ScadaBR flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an OpenPLC ScadaBR flaw to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2021-26828, with a CVSS score of 8.7. The vulnerability is described as an unrestricted upload of file with dangerous type vulnerability, allowing remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm on OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows.

This addition follows CISA’s prior inclusion of another OpenPLC ScadaBR flaw, tracked as CVE-2021-26829, with a CVSS score of 5.4. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address the identified vulnerabilities by the due date to protect their networks. CISA orders federal agencies to fix the vulnerabilities by 24 December 2025. Experts also recommend that private organisations review the KEV Catalog and address the vulnerabilities in their infrastructure.