EUVD-2026-21009
GHSA-3r9q-7hff-7fm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover OpenPLC_V3 API endpoint
-
ExploitExploit insecure default credentials
-
ExecutionBypass authentication mechanism
-
ImpactGain unauthorized system access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V13 - Configuration Secure default settings
|
| Exploitation Conditions | Remote unauthenticated attacker exploits insecure default API authentication in OpenPLC_V3. Requires the API endpoint to be accessible over the network with default insecure credentials or authentication bypass enabled. No victim interaction needed. |
| Impact | Critical unauthenticated network-accessible authentication bypass in OpenPLC_V3 via insecure API defaults. CVSS 9.2 reflects high integrity/availability impact. Affects industrial control systems directly; attackers need only network access and timing to exploit. CISA ICS advisory confirmation elevates priority despite low EPSS baseline. |
| Exploit ScenarioDerived | Attacker sends crafted API request to OpenPLC_V3 network endpoint exploiting insecure default initialization. Authentication bypass grants full system access without credentials. No attack complexity required; unauthenticated, low-tier network positioning sufficient for compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Authentication bypass in OpenPLC_V3 allows unauthenticated remote attackers to gain unauthorized system access through insecurely configured API endpoints. The vulnerability stems from insecure default resource initialization (CWE-1188), enabling complete circumvention of authentication mechanisms. Attackers can exploit this over the network with low attack complexity to achieve high confidentiality, integrity, and availability impact across vulnerable and subsequent systems. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate mitigation: disable or restrict network access to OpenPLC_V3 API endpoints via firewall rules permitting only trusted IP ranges. Implement reverse proxy with mandatory authentication layer before API. Change all default credentials if configurable. Monitor CISA ICS advisory ICSA-25-345-10 for vendor patch announcements: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10. For production ICS environments, consider isolating affected systems on dedicated network segments with strict access controls until patches release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause: insecure default initialization (CWE-1188) in API authentication layer. CVSS v4.0 vector confirms unauthenticated network attack (PR:N, AV:N) with cross-system impact (SC:L/SI:H/SA:H). Default credentials or missing authentication checks in API endpoints enable complete access control bypass without user interaction.
Know when Openplc V3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API.
Executive ViewAI
CVE-2026-28205 is a critical authentication bypass in OpenPLC_V3 that allows unauthenticated remote attackers to gain complete system access through improperly initialized API endpoints, directly threatening the integrity and availability of industrial control systems and any dependent infrastructure. Organizations running OpenPLC_V3 face immediate risk of unauthorized access, data compromise, and operational disruption, with potential cascade effects to connected systems.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-based access controls restricting API endpoint connectivity to authorized internal networks only; (2) Deploy Web Application Firewall (WAF) rules to detect and block suspicious API requests; (3) Enable detailed API request logging and establish continuous monitoring for anomalous authentication patterns; (4) Isolate OpenPLC_V3 systems on segregated network segments with restricted egress; (5) Establish incident response procedures for potential unauthorized access; (6) Consider temporary decommissioning of non-critical OpenPLC_V3 instances until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Openplc V3
View allArbitrary file write leading to remote code execution in OpenPLC Runtime v3 lets a low-privileged web user upload a craf
Plaintext credential storage in OpenPLC_V3 enables network-based attackers to retrieve authentication credentials withou
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_de
Authorization bypass in OpenPLC_V3 REST API allows authenticated low-privilege users to delete administrator accounts or
Exploit-DB