PT-2021-17153 · Microsoft · Windows

H3V0X · Published 2021-06-11 · Updated 2025-11-29 · CVE-2021-26829

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenPLC ScadaBR versions through 0.9.1 on Linux OpenPLC ScadaBR versions through 1.12.4 on Windows

Description OpenPLC ScadaBR is susceptible to a stored cross-site scripting (XSS) issue. The issue is triggered through the

system settings.shtm

file. The pro-Russian hacktivist group TwoNet exploited this and other issues, including default credentials, to fabricate attacks on water treatment systems and disrupt operations by disabling logs and alarms. This represents a shift towards interference with operational technology (OT) and industrial control systems (ICS).

Recommendations OpenPLC ScadaBR versions through 0.9.1 on Linux should be updated. OpenPLC ScadaBR versions through 1.12.4 on Windows should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-26829

Affected Products

Windows

References · 15

• 🔥 https://youtu.be/Xh6LPCiLMa8 · Exploit
• http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26829 · Security Note
• https://twitter.com/transilienceai/status/1976890229702181236 · Twitter Post
• https://t.me/pentestingnews/71292 · Telegram Post
• https://t.me/cvenotify/16181 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1994505049892868473 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1976293553241276524 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26829 · Note
• https://forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics · Note
• https://twitter.com/CISACyber/status/1994478182041285112 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1977613250591117381 · Twitter Post
• https://t.me/aptreports/22682 · Telegram Post
• https://twitter.com/fridaysecurity/status/1994584477331591473 · Twitter Post
• https://t.me/cibsecurity/25374 · Telegram Post