OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Description

References

• forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4 · Broken Link
• packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html · Exploit
• youtu.be/k1teIStQr1A · Exploit
• SCADA-LTS/Scada-LTS#2174 · Issue Tracking
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2021-26828

scadabr의 다른 취약점

• CVE-2026-9646보통 6.1A reflected cross-site scripting issue exists in URL handling.
• CVE-2026-9645심각 9.9Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full acces…
• CVE-2026-8605심각 9.8In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
• CVE-2026-8604높음 8.8In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by lur…
• CVE-2026-8603심각 9.8In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.