Veille CVE
CVE-2021-26828
8.8 Élevée Exploitée activementCatalogue CISA KEV — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
Ajoutée le 03/12/2025 · Échéance de correction (agences US) : 24/12/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 6.5 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4 Broken LinkExploitVendor Advisory
- http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html ExploitThird Party Advisory
- https://youtu.be/k1teIStQr1A ExploitThird Party Advisory
- http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4 Broken LinkExploitVendor Advisory
- http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html ExploitThird Party Advisory
- https://youtu.be/k1teIStQr1A ExploitThird Party Advisory
- https://github.com/SCADA-LTS/Scada-LTS/pull/2174 Issue TrackingPatch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828 US Government Resource