openPDC Docker Image CVE-2026-105278

Exploitation requires that openPDC was deployed from the official published Docker image (which embeds the fixed administrative credential) AND that the embedded credential was not changed from its default, AND that the attacker can reach the management interface over the network. Source-built or manually provisioned deployments that set their own credentials, and deployments whose management interface is not exposed to attacker-reachable networks, are not affected. No user interaction or prior privileges are needed once the interface is reachable (CVSS PR:N/UI:N), so the practical limiting factors are the Docker-image deployment mode, retention of the default credential, and network exposure of the management interface.

Signals are largely consistent and point to a genuine high-severity issue for affected deployments. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) describes a trivially exploitable network-reachable flaw with full confidentiality, integrity, and availability impact on the vulnerable system and no scope change, which matches CWE-798 (use of hard-coded credentials) and the description of a fixed administrative credential shipped in the openPDC Docker image. No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is not indicated in the input, so this is NOT confirmed actively exploited; there is no public exploit identified at time of analysis. The main factor tempering real-world risk is deployment scope rather than exploitability: the flaw is specific to the official Docker image distribution of openPDC - an OT/ICS synchrophasor data concentrator used by electric utilities - not the general source-built product, and operators who changed the default credential or who do not expose the management interface to untrusted networks are not realistically at risk. Treat as a real priority for anyone running the openPDC Docker image with an exposed management interface, while noting that the affected product has a narrow, industry-specific footprint.

An attacker with network reachability to the openPDC management interface of a container deployed from the official Docker image logs in using the fixed administrative credential shipped with that image, which was never forced to change on first use. Because the credential is static and publicly derivable from the image, the attacker immediately obtains full administrative control over the phasor data concentrator. No public exploit code is identified at time of analysis, but exploitation requires only knowledge of the baked-in credential and basic authentication.