openPDC EUVD-2026-95782

Exploitation requires an authenticated low-privilege account on openPDC (PR:L) and access to the Modbus connection feature, which accepts a caller-specified destination address and port with no allow-list or restriction on which internal hosts may be targeted - that unrestricted destination input IS the enabling condition. Limiting factors: valid credentials are mandatory (not exploitable pre-authentication), impact is limited to internal reachability disclosure/network mapping rather than data theft or code execution, and realistic risk depends on openPDC being reachable by an attacker-controlled account and sitting on a segment with interesting internal hosts to probe.

This is a medium-severity SSRF (CWE-918) that the CVSS 4.0 vector rates at 5.3, driven by a limited-confidentiality outcome: the vector is AV:N/AC:L/AT:N/PR:L/UI:N with VC:L and no integrity or availability impact (VI:N/VA:N), and no subsequent-system impact (SC:N/SI:N/SA:N). The PR:L metric confirms this requires an authenticated user, not an anonymous remote attacker, which meaningfully lowers real-world risk versus a PR:N flaw. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code was referenced, so exploitation status is: no public exploit identified at time of analysis. The signals are internally consistent - there is no CVSS-versus-description conflict here; the description (authenticated user, internal reconnaissance only) aligns with the low-confidentiality, authenticated vector. The practical takeaway is that this is a reconnaissance/information-exposure primitive (internal network mapping), not a direct code-execution or data-theft bug, so it is best treated as a lower-priority finding that gains importance mainly as a stepping stone within a broader intrusion of an ICS/OT environment. Missing data: EPSS probability and any POC status are absent and cannot be inferred.

An attacker who already holds valid (low-privilege) credentials to openPDC uses the Modbus connection feature to specify arbitrary internal IP addresses and ports as the connection destination, observing response/timing differences to determine which internal hosts and services are reachable. By iterating across address and port ranges, they build a map of the internal OT/ICS network for use in later lateral movement. No public exploit code is referenced, so this would rely on manual abuse of the legitimate feature.