OpenPLC ScadaBR is vulnerable to arbitrary file upload and remote code execution, a flaw that is currently being actively exploited in the wild.

This vulnerability involves an unrestricted file upload flaw where a remote authenticated user can upload and execute arbitrary JSP files through the view_edit.shtm endpoint. The vulnerability facilitates remote code execution, allowing an attacker with authenticated access to compromise the underlying system.

The potential impact of this vulnerability is critical, as reflected by its CVSS score of 9.5. Successful exploitation allows unauthorized attackers to execute arbitrary code on industrial control system infrastructure, which can result in complete system compromise, data theft, and significant operational disruption. The inclusion of this vulnerability in the CISA Known Exploited Vulnerabilities catalog further emphasizes the high risk of widespread damage to affected organizations.

Immediate Action: Review the official vendor forum advisory for available mitigations, as no specific patch version has been provided. If no official patch is available, organizations should restrict access to the affected management interface or discontinue use of the product until a secure version is identified.

Proactive Monitoring: Monitor network and server logs for unusual HTTP POST requests directed at the view_edit.shtm file, particularly those containing suspicious file extensions or JSP content.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized file uploads and restrict access to the ScadaBR administrative interface to trusted IP addresses only.

Public Exploit Available: Yes, multiple public proof-of-concept repositories are available on GitHub and through Packet Storm Security.

Given the confirmed active exploitation and the critical nature of this remote code execution vulnerability, immediate action is required to protect affected environments. Security teams must treat this as a high priority, isolating vulnerable ScadaBR instances from public networks and applying all available vendor-recommended mitigations to prevent further unauthorized access and system compromise.