Openplcproject
Openplcproject Openplc V3 Firmware: vulnerabilidades y CVE
Openplcproject Openplc V3 Firmware tiene 12 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses4
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-31156 | Media (6.5) | 0.46% | — | 13 may 2026 | A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed… |
| CVE-2026-35063 | Alta (8.7) | 0.43% | — | 9 abr 2026 | OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they… |
| CVE-2026-35556 | Crítica (9.2) | 0.40% | — | 9 abr 2026 | OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. |
| CVE-2026-28205 | Crítica (9.2) | 0.67% | — | 9 abr 2026 | OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API. |
| CVE-2024-39590 | Alta (7.5) | 1.0% | — | 18 sept 2024 | Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a. A specially crafted EtherNet/IP request can lead… |
| CVE-2024-39589 | Alta (7.5) | 1.0% | — | 18 sept 2024 | Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a36d95b73e7b8722d0edb8b9c5bb56a. A specially crafted EtherNet/IP request can lead… |
| CVE-2024-36981 | Alta (7.5) | 1.0% | — | 18 sept 2024 | An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted network request can lead to denial of… |
| CVE-2024-36980 | Alta (7.5) | 1.1% | — | 18 sept 2024 | An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted network request can lead to denial of… |
| CVE-2024-34026 | Crítica (9.8) | 2.4% | — | 18 sept 2024 | A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted EtherNet/IP request can lead to… |
| CVE-2024-37741 | Media (5.4) | 0.33% | — | 28 jun 2024 | OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture. |
| CVE-2021-31630 | Alta (8.8) | 27% | — | 3 ago 2021 | Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application. |
| CVE-2018-20818 | Crítica (9.8) | 1.5% | — | 22 abr 2019 | A buffer overflow vulnerability was discovered in the OpenPLC controller, in the OpenPLC_v2 and OpenPLC_v3 versions. It occurs in the modbus.cpp mapUnusedIO() function, which can cause a runtime crash of the PLC or… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.