The Cybersecurity and Infrastructure Security Agency has issued a critical alert regarding an unrestricted file upload vulnerability in OpenPLC ScadaBR that poses significant risks to industrial control systems and operational technology environments.
The vulnerability, identified through remote attack vectors, allows authenticated users to bypass security controls and upload malicious JSP files that can be executed on affected systems.
The Vulnerability
OpenPLC ScadaBR contains a dangerous file upload vulnerability accessible through the view_edit.shtm interface.
The flaw permits remote authenticated users to circumvent file type restrictions and upload JSP files, which are then executed within the application’s context.
This capability creates a direct pathway for attackers to achieve remote code execution on systems running vulnerable versions of the software.
The vulnerability represents a critical security weakness in web application controls designed to prevent the upload of executable files.
The weakness is classified under CWE-434, which describes improper restriction of rendered UI layers or frames.
This category encompasses flaws where applications fail to properly validate and restrict file uploads, enabling attackers to execute arbitrary code through file type confusion or insufficient validation mechanisms.
CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on December 3, 2025, indicating active exploitation in the wild.
Organizations running OpenPLC ScadaBR must address this issue by the mandatory deadline of December 24, 2025.
The vulnerability affects industrial automation systems, particularly SCADA and supervisory control environments relied upon by critical infrastructure operators.
While current reporting does not confirm ransomware deployment through this vulnerability, the ability to execute arbitrary code suggests high potential for data theft, system compromise, and lateral movement within networked environments. Critical infrastructure operators should treat this threat with elevated priority.
CISA provides specific guidance for affected organizations. First, apply all available mitigations as instructed by the vendor.
Second, for organizations operating OpenPLC ScadaBR as a cloud-based service, follow the requirements outlined in Binding Operational Directive 22-01, which establishes mandatory security controls for federal information systems.
Third, if mitigations prove unavailable or insufficient, organizations should consider discontinuing use of the product and transitioning to alternative solutions.
Administrators should immediately inventory systems running OpenPLC ScadaBR, prioritize patching efforts, and implement network segmentation to limit exposure.
Multi-factor authentication should be enforced to reduce the risk of unauthorized access by remote authenticated users.
| Aspect | Details |
|---|---|
| Product | OpenPLC ScadaBR |
| Vulnerability Type | Unrestricted File Upload with Dangerous Type |
| CWE Classification | CWE-434 |
| Attack Vector | view_edit.shtm endpoint |
| Authentication Required | Yes (Remote Authenticated Users) |
| Known Ransomware Use | Unknown/Unconfirmed |
| Date Added to KEV Catalog | December 3, 2025 |
| Remediation Deadline | December 24, 2025 |
| Recommended Action | Apply vendor mitigations or discontinue use |
Industrial organizations should verify current software versions and establish communication with OpenPLC developers regarding patch availability and deployment timelines.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The vulnerability, identified through remote attack vectors, allows authenticated users to bypass security controls and upload malicious JSP files that can be executed on affected systems.){kind=link}