CISA’s Naughty List: New OpenPLC Flaw Gets Coal in Exploited Vulnerabilities Catalog
OpenPLC ScadaBR flaw joins CISA’s Known Exploited Vulnerabilities catalog, just in time for the holiday season! This security bug, which lets authenticated users upload and execute arbitrary files, has a CVSS score of 8.7. Federal agencies are on a deadline to fix it by December 24, 2025—talk about a Christmas miracle!
Hot Take:
Looks like the OpenPLC ScadaBR is giving Santa a run for his money with vulnerabilities that have been making quite the naughty list. CISA is stepping in to ensure that these flaws are patched up quicker than holiday shopping can empty a wallet. Forget about reindeer; it’s the rogue JSP files you should be worried about this season!
Key Points:
- CISA added a new OpenPLC ScadaBR flaw, CVE-2021-26828, to its Known Exploited Vulnerabilities catalog.
- The flaw is of the unrestricted upload of file with dangerous type variety, with a CVSS score of 8.7.
- A cross-site scripting (XSS) flaw, CVE-2021-26829, was also added, affecting both Windows and Linux versions.
- The Binding Operational Directive mandates federal agencies to fix these vulnerabilities by December 24, 2025.
- Private organizations are advised to review and address these vulnerabilities in their infrastructure.
Already a member? Log in here