openPDC CVE-2026-105281

Exploitation requires network reachability to the openPDC internal data publisher interface, which in its DEFAULT configuration accepts connections without any authentication - no credentials, tokens, or user interaction are needed. The concrete prerequisite is simply that an attacker can establish a TCP connection to this publisher endpoint and issue a subscription request. The primary limiting factor is network exposure: in properly segmented OT/ICS environments the publisher is not reachable from untrusted networks, which sharply reduces realistic exposure, whereas flat networks or inadvertently exposed instances are fully exploitable. Impact is further bounded to read-only disclosure of device and measurement topology (VC:H, no integrity or availability impact), so the attacker cannot alter or disrupt operation through this flaw alone.

All signals point to a genuine but bounded confidentiality risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation requiring no user interaction, which aligns cleanly with CWE-306 (Missing Authentication) and the description of an internal data publisher that accepts connections without authentication in its default configuration. However, impact is limited to VC:H with VI:N/VA:N - this is pure information disclosure of device and measurement topology, not code execution, data tampering, or denial of service, which is why the score lands at 8.7 rather than near 10. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the 8.7 reflects ease and reach of the disclosure, not weaponized impact. The practical risk is best understood as reconnaissance-grade: an attacker gains a full map of grid synchrophasor devices and measurements that could seed a follow-on OT attack, but exploitation presupposes network reachability to the publisher interface, which in well-segmented ICS environments is a meaningful limiter. Treat as a real priority for internet- or flat-network-exposed openPDC instances, and as lower urgency where OT segmentation isolates the interface.

An attacker with network reachability to an openPDC host connects directly to the internal data publisher interface, which in its default configuration requires no authentication. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the attacker simply subscribes and retrieves the complete device and measurement topology without credentials or user interaction. No public exploit is identified at time of analysis, but the interaction is trivial enough to script against any reachable instance.