OpenPLC_V3 (Update A)
Successful exploitation of these vulnerabilities could result in the alteration of PLC settings, upload of malicious programs, access to credentials, or bypass authentication.
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35063US | high8.8OT elevated | — | ||
OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators… | ||||
| CVE-2026-35556US | high7.5 | — | ||
OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. | ||||
| CVE-2026-28205US | critical9.8OT elevated | — | ||
OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentic… | ||||
| CVE-2025-13970US | — | — | ||
OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack
due to the absence of proper CSRF validation. This issue allows an
unauthenticated attacker to trick a logg… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-25-345-10 JSONself
- ICSA Advisory ICSA-25-345-10 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationOpenPLC_v3
OpenPLC_v3 is now considered to be end of life. Users are recommended to upgrade to OpenPLC Runtime v4 (https://github.com/autonomy-logic/openplc-runtime).
https://github.com/autonomy-logic/openplc-runtime - MitigationOpenPLC_v3
OpenPLC_v3 is now considered to be end of life. Users are recommended to upgrade to OpenPLC Runtime v4 (https://github.com/autonomy-logic/openplc-runtime).
https://github.com/autonomy-logic/openplc-runtime - MitigationOpenPLC_v3
OpenPLC_v3 is now considered to be end of life. Users are recommended to upgrade to OpenPLC Runtime v4 (https://github.com/autonomy-logic/openplc-runtime).
https://github.com/autonomy-logic/openplc-runtime - MitigationOpenPLC_v3
OpenPLC_v3 is now considered to be end of life. Users are recommended to upgrade to OpenPLC Runtime v4 (https://github.com/autonomy-logic/openplc-runtime).
https://github.com/autonomy-logic/openplc-runtime
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan