CISA Warns of ScadaBR Vulnerability After Hacktivist ICS Attack

The cybersecurity agency CISA has added the ScadaBR vulnerability (CVE-2021-26829) to its Known Exploited Vulnerabilities (KEV) catalog, following its exploitation by the pro-Russia hacktivist group TwoNet. This medium severity cross-site scripting (XSS) flaw, patched in June 2021, was used to deface a fake human-machine interface (HMI) associated with an ICS/OT honeypot mimicking a water treatment plant.

The hackers altered the HMI login page to display a message claiming it was hacked, although the attack had no real-world impact. CISA has instructed government agencies to address this vulnerability by December 19. The incident highlights the potential targeting of CVE-2021-26829 by other threat actors, although no other in-the-wild exploitation reports have surfaced.