EUVD-2026-45380
GHSA-3x22-r5w3-j249
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 18, 2026
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Openplc V3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interface can send a crafted HTTP POST to the /modbus endpoint with an oversized device_name value; the value is persisted to mbconfig.cfg and parsed on load, overflowing dev_name and overwriting adjacent struct fields (protocol at offset 108, dev_address at offset 109, ip_port at offset 210). A 200-byte payload writes 100 bytes past the allocation. The result is heap corruption leading to runtime crash and denial of service of the PLC process control loop, with attacker-controlled overwrite of adjacent configuration fields. The upstream repository was archived on 2026-04-04 and no fix is expected; the vendor has confirmed the issue does not affect OpenPLC Runtime v4.
Executive ViewAI
OpenPLC_v3, an archived industrial control system platform, contains a high-severity buffer overflow vulnerability in its Modbus configuration endpoint that allows authenticated web-interface users to crash the PLC control loop through oversized device name input. Organizations running this platform face direct operational continuity risk in manufacturing and process control environments. The archived repository status and absence of vendor patches create an indefinite exposure window requiring immediate containment.
Within 24 hours: Inventory all OpenPLC_v3 installations and restrict web interface access to trusted administrative networks only; audit active user accounts and revoke unnecessary web interface credentials. Within 7 days: Implement input validation on the device_name field (enforce 100-byte maximum) via application-level controls or Web Application Firewall rules to prevent buffer overflow attempts; test Modbus functionality to confirm operational integrity. Within 30 days: Initiate migration planning to an actively maintained PLC platform; if OpenPLC_v3 must remain in production, fork the archived repository, apply security hardening with additional bounds checking, and establish an internal patch protocol.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to the /modbus endpoint to dedicated administrative networks only; (2) Enforce strict input validation limiting device_name to 100 bytes maximum; (3) Deploy Web Application Firewall rules to reject oversized device_name parameters; (4) Disable Modbus functionality if operationally feasible; (5) Implement monitoring and alerting on PLC control loop failures with automated recovery procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Openplc V3
View allArbitrary file write leading to remote code execution in OpenPLC Runtime v3 lets a low-privileged web user upload a craf
Authentication bypass in OpenPLC_V3 allows unauthenticated remote attackers to gain unauthorized system access through i
Plaintext credential storage in OpenPLC_V3 enables network-based attackers to retrieve authentication credentials withou
Authorization bypass in OpenPLC_V3 REST API allows authenticated low-privilege users to delete administrator accounts or
Exploit-DB