OpenPLC V3 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting OpenPLC V3 products: 4 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-35063 High · 8.8 CWE-862 Apr 9, 2026

Missing Authorization in OpenPLC_V3

OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access.

CVE-2026-35556 High · 7.5 CWE-256 Apr 9, 2026

Plaintext storage of a password in OpenPLC_V3

OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.

CVE-2026-28205 Critical · 9.8 CWE-1188 Apr 9, 2026

Initialization of a resource with an insecure default in OpenPLC_V3

OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API.

CVE-2025-13970 High · 8.0 CWE-352 Dec 12, 2025

OpenPLC_V3 Cross-Site Request Forgery

OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settings or the upload of malicious programs which could lead to significant disruption or damage to connected systems.