CVE-2026-28205

The vulnerability results from improper resource initialization, which in its default state does not require authentication credentials. A network attacker, without needing to possess an account or any user interaction, can send requests to the OpenPLC V3 API and gain access to functions requiring authorization. The flaw affects both the firmware layer and OpenPLC V3 software, meaning that both hardware devices and software installations are vulnerable.

An attacker can bypass the authentication mechanism and gain unauthorized access to the OpenPLC V3 system, which in an industrial environment could lead to unauthorized data reading, modification of control logic, or disruption of the control system's availability.

Patches available from the manufacturer should be applied in accordance with the references (CISA ICS Advisory ICSA-25-345-10). Additionally, it is recommended to isolate OpenPLC systems from public networks, restrict API access exclusively to trusted hosts, and verify and change default authentication configurations.

Openplcproject OpenPLC V3 Firmware and Openplcproject OpenPLC V3 — versions indicated in manufacturer references (CISA advisory ICSA-25-345-10)