openPDC CVE-2026-85479

The STTP-based data publisher interface must be present and network-reachable by the attacker, and the openPDC/openHistorian instance must be running its DEFAULT configuration in which the publisher accepts connections without authentication. No user interaction, credentials, or special privileges are required (PR:N/UI:N). Exploitation is LIMITED by the fact that this is OT software normally expected to reside behind network segmentation/firewalls; if the STTP port is not routable from the attacker's position, or if operators have enabled authentication/TLS on the publisher, the issue is not exploitable. Impact is confined to data access/exchange (C:L) with no stated ability to alter measurements or disrupt availability.

This is a genuine but moderate-severity exposure, not a top-tier emergency. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the description: an unauthenticated remote attacker can reach the STTP data publisher over the network with low complexity, but impact is limited to low confidentiality loss (data exchange/read) with no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization - this appears to be a vendor/ICS-CERT-coordinated disclosure rather than an in-the-wild threat. The real-world risk is tempered by deployment context: openPDC and openHistorian are synchrophasor/OT applications typically expected to run inside segmented utility networks, so AV:N reflects network reachability on the STTP interface, not necessarily internet exposure. Priority should be driven by whether the publisher interface is reachable beyond trusted OT segments; where it is isolated, this is a lower-priority hardening item despite the network vector.

An attacker with network reachability to an openPDC or openHistorian host connects to the STTP-based data publisher interface, which in its default configuration requires no authentication. The attacker subscribes to or exchanges data with the interface, obtaining synchrophasor/measurement data streams they should not have access to. No public exploit code was identified; exploitation requires only a standard STTP client and a route to the listening port.