Openplc Runtime
Monthly
Reflected cross-site scripting in Autonomy Logic OpenPLC 3 (OpenPLC Runtime) lets a remote, unauthenticated attacker craft a URL whose routing query-string parameter carries script payload that is reflected into the page without encoding, executing in the browser of any operator who clicks the link while holding an active web-management session. Exploitation is entirely dependent on social engineering of a legitimate operator (UI:R per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) and the web interface must be network-reachable to that operator. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); impact is confined to the victim's browser session and same-origin web context, with no direct compromise of the PLC runtime or loss of availability.
Reflected cross-site scripting in Autonomy Logic OpenPLC 3 (OpenPLC Runtime) lets a remote, unauthenticated attacker craft a URL whose routing query-string parameter carries script payload that is reflected into the page without encoding, executing in the browser of any operator who clicks the link while holding an active web-management session. Exploitation is entirely dependent on social engineering of a legitimate operator (UI:R per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) and the web interface must be network-reachable to that operator. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); impact is confined to the victim's browser session and same-origin web context, with no direct compromise of the PLC runtime or loss of availability.