Openhistorian
Monthly
Arbitrary constructor code execution in Grid Protection Alliance openPDC and openHistorian is reachable by an authenticated user who is also able to place a file on the host filesystem, because the component-loading routine instantiates any type name it is given without validating that the type is a legitimate component (CWE-470, unsafe reflection). Successful abuse executes attacker-supplied constructor code with the privileges of the affected service account, giving high confidentiality, integrity and availability impact on the affected instance. Exploitation is conditional rather than trivial - CVSS 4.0 scores it 7.7 with attack requirements present (AT:P) and low privileges required (PR:L), an independent assessment agrees on AV:N/AC:H/PR:L with high C/I/A impact, and no public exploit was identified at time of analysis (no CISA KEV listing, no PoC reported).
Unauthenticated access to the openPDC internal data publisher lets any host that can reach the service connect and subscribe without credentials, tokens, or user interaction, retrieving the complete device and measurement topology - the full model of phasor measurement units, devices, and signal names that describes a synchrophasor deployment. The affected software set, per vendor CPE entries, covers openPDC, the openPDC Docker image, and openHistorian, with CISA ICS advisory ICSA-26-281-02 documenting the missing-authentication weakness (CWE-306); the assessed vector requires no authentication (PR:N) and yields a high-confidentiality, read-only exposure with no integrity or availability impact, so an attacker cannot alter or disrupt operations through this flaw alone. No public exploit identified at time of analysis, and realistic risk is dominated by network exposure: properly segmented OT/ICS networks sharply limit reachability, while flat networks or inadvertently internet-exposed publisher endpoints are fully exploitable.
Insecure deserialization in the service console interface of openPDC and openHistorian lets an attacker submit a crafted serialized object graph to a function that deserializes client-supplied data, potentially achieving remote code execution under the privileges of the affected service account. Grid Protection Alliance's openPDC, its Docker image, and openHistorian are all affected, with CPE data indicating no version restriction (all releases). Whether the flaw is remotely exploitable without credentials depends entirely on configuration: deployments without Windows Authentication are reachable by an unauthenticated network attacker (the CVSS 4.0 vector carries PR:N), while deployments with Windows Authentication require the attacker to already hold valid authenticated access. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, but the assessed CVSS:3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) and the absence of user interaction make this a genuine high-priority issue for exposed, unauthenticated console interfaces in OT environments.
An authenticated low-privilege user of openPDC can abuse the Modbus connection feature to make outbound connections to arbitrary internal destination addresses and ports, because the destination input is caller-controlled and not validated against any allow-list. The result is a server-side request forgery (CWE-918) condition that leaks reachability information - an attacker can distinguish which internal hosts and ports respond and, through repeated probes, gradually map the internal network - but no data theft, code execution, integrity, or availability impact is possible. The vulnerability is rated 5.3 under both the vendor's CVSS 4.0 vector and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting that valid credentials are mandatory and the only confirmed impact is limited confidentiality disclosure; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Unauthenticated access to the STTP-based data publisher in Grid Protection Alliance openPDC, the openPDC Docker image, and openHistorian default configurations allows remote attackers to connect to the interface and exchange data without credentials, resulting in a confidentiality exposure scored CVSS 5.3 (C:L, I:N, A:N). Exploitation requires the STTP listener to be network-reachable and authentication/TLS to remain disabled, and impact is limited to data access/exchange with no stated ability to alter measurements or disrupt availability. No public exploit identified at time of analysis, and the expected OT network segmentation around these systems is a key mitigating factor.
Arbitrary constructor code execution in Grid Protection Alliance openPDC and openHistorian is reachable by an authenticated user who is also able to place a file on the host filesystem, because the component-loading routine instantiates any type name it is given without validating that the type is a legitimate component (CWE-470, unsafe reflection). Successful abuse executes attacker-supplied constructor code with the privileges of the affected service account, giving high confidentiality, integrity and availability impact on the affected instance. Exploitation is conditional rather than trivial - CVSS 4.0 scores it 7.7 with attack requirements present (AT:P) and low privileges required (PR:L), an independent assessment agrees on AV:N/AC:H/PR:L with high C/I/A impact, and no public exploit was identified at time of analysis (no CISA KEV listing, no PoC reported).
Unauthenticated access to the openPDC internal data publisher lets any host that can reach the service connect and subscribe without credentials, tokens, or user interaction, retrieving the complete device and measurement topology - the full model of phasor measurement units, devices, and signal names that describes a synchrophasor deployment. The affected software set, per vendor CPE entries, covers openPDC, the openPDC Docker image, and openHistorian, with CISA ICS advisory ICSA-26-281-02 documenting the missing-authentication weakness (CWE-306); the assessed vector requires no authentication (PR:N) and yields a high-confidentiality, read-only exposure with no integrity or availability impact, so an attacker cannot alter or disrupt operations through this flaw alone. No public exploit identified at time of analysis, and realistic risk is dominated by network exposure: properly segmented OT/ICS networks sharply limit reachability, while flat networks or inadvertently internet-exposed publisher endpoints are fully exploitable.
Insecure deserialization in the service console interface of openPDC and openHistorian lets an attacker submit a crafted serialized object graph to a function that deserializes client-supplied data, potentially achieving remote code execution under the privileges of the affected service account. Grid Protection Alliance's openPDC, its Docker image, and openHistorian are all affected, with CPE data indicating no version restriction (all releases). Whether the flaw is remotely exploitable without credentials depends entirely on configuration: deployments without Windows Authentication are reachable by an unauthenticated network attacker (the CVSS 4.0 vector carries PR:N), while deployments with Windows Authentication require the attacker to already hold valid authenticated access. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, but the assessed CVSS:3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) and the absence of user interaction make this a genuine high-priority issue for exposed, unauthenticated console interfaces in OT environments.
An authenticated low-privilege user of openPDC can abuse the Modbus connection feature to make outbound connections to arbitrary internal destination addresses and ports, because the destination input is caller-controlled and not validated against any allow-list. The result is a server-side request forgery (CWE-918) condition that leaks reachability information - an attacker can distinguish which internal hosts and ports respond and, through repeated probes, gradually map the internal network - but no data theft, code execution, integrity, or availability impact is possible. The vulnerability is rated 5.3 under both the vendor's CVSS 4.0 vector and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting that valid credentials are mandatory and the only confirmed impact is limited confidentiality disclosure; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Unauthenticated access to the STTP-based data publisher in Grid Protection Alliance openPDC, the openPDC Docker image, and openHistorian default configurations allows remote attackers to connect to the interface and exchange data without credentials, resulting in a confidentiality exposure scored CVSS 5.3 (C:L, I:N, A:N). Exploitation requires the STTP listener to be network-reachable and authentication/TLS to remain disabled, and impact is limited to data access/exchange with no stated ability to alter measurements or disrupt availability. No public exploit identified at time of analysis, and the expected OT network segmentation around these systems is a key mitigating factor.