OpenPLC CVE-2025-53476
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ModbusTCP port over network
-
DeliveryOpen series of TCP connections
-
ExploitExhaust unreleased connection resources
-
ExecutionServer stops processing Modbus requests
-
ImpactDenial of service to control logic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release before removal
|
| Exploitation Conditions | Exploitation requires network access to the OpenPLC v3 ModbusTCP server (default TCP/502), which must be running and reachable - this is core, commonly-enabled functionality rather than a non-default feature. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and complexity is low (AC:L): the attacker simply opens a series of TCP connections. The primary limiting factor is reachability - in correctly segmented OT networks the Modbus port should not be exposed to untrusted networks, which sharply reduces realistic exposure. Impact is limited to availability degradation of Modbus request processing; no data exposure or code execution results. Affects the specific OpenPLC v3 build at commit a931181e8b81e36fadf7b74d5cba99b73c3f6d58. |
| Impact | This is a genuine but low-to-moderate priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) confirms a network-reachable, low-complexity, unauthenticated attack whose only impact is partial availability loss (A:L) - no confidentiality or integrity impact. CWE-775 (missing release of resource) aligns with the description: opening a series of TCP connections exhausts resources so the ModbusTCP server stops processing subsequent Modbus requests. EPSS is low at 0.46% (38th percentile), the CVE is NOT in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation. The signals are consistent rather than conflicting - a trivially triggerable DoS that nonetheless caps out at degraded availability. The real-world weight comes from context: OpenPLC drives industrial/OT processes, where loss of Modbus responsiveness can halt control logic, so operators of exposed instances should patch, but this is not a drop-everything internet-wide emergency. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker with network reachability to an OpenPLC v3 device's ModbusTCP service rapidly opens a series of TCP connections that are never properly released, exhausting server resources. Once the limit is reached, the Modbus server stops answering legitimate Modbus requests, disrupting the industrial control process it serves. No authentication or user interaction is required (PR:N/UI:N), and attack complexity is low (AC:L); no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in OpenPLC v3's ModbusTCP server (build a931181e8b81e36fadf7b74d5cba99b73c3f6d58) allows unauthenticated remote attackers to open a series of TCP connections that cause the server to stop processing subsequent Modbus requests. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and EPSS is low at 0.46% (38th percentile). No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation is not confirmed actively exploited.
RemediationAI
No vendor-released patch is identified in the provided references; consult the Talos advisory (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2223) for any OpenPLC update. Because the attack requires reachability to the ModbusTCP server (default TCP/502), the highest-value mitigation is to block or restrict TCP/502 to trusted engineering hosts only, using OT network segmentation or firewall rules-this is effective but will prevent legitimate remote Modbus clients if they are not on the trusted list. If ModbusTCP is not required, disable the ModbusTCP server in OpenPLC, accepting the loss of that protocol functionality. Where the service must remain reachable, apply connection-rate limits (e.g., iptables connlimit or equivalent) to slow the series of TCP connections, understanding that aggressive limits may throttle legitimate polling traffic. Monitor for unusual spikes in TCP connections to the PLC and apply the vendor fix once available.
Affected ProductsAI
OpenPLC v3 at commit a931181e8b81e36fadf7b74d5cba99b73c3f6d58 is affected in its ModbusTCP server functionality. The advisory Talos TALOS-2025-2223 (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2223) documents the issue. No CPE string was supplied in the available data, so the exact breadth beyond this commit should be confirmed with the vendor.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenPLC v3 is an open-source programmable logic controller runtime; its ModbusTCP server listens on TCP/502 by default. The flaw maps to CWE-775 (Missing Release of File Descriptor or Handle after Effective Lifetime), meaning the server does not properly release socket or handle resources when a series of TCP connections are opened, exhausting connection-handling capacity and causing subsequent Modbus requests to go unprocessed. The affected build is commit a931181e8b81e36fadf7b74d5cba99b73c3f6d58; Talos advisory TALOS-2025-2223 provides the underlying report. No authentication or user interaction is required (CVSS PR:N/UI:N) and attack complexity is low (AC:L), but impact is limited to availability (A:L) with no confidentiality or integrity effect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remotely reachable unauthenticated Modbus service (AV:N/PR:N/UI:N), trivial connection-flood trigger (AC:L), and only partial availability loss with no C/I impact (A:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted series of network connections can lead to the server not processing subsequent Modbus requests. An attacker can open a series of TCP connections to trigger this vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB