CVE-2026-35556

According to CWE-256, the application stores passwords in an unsecured manner — in plaintext — instead of using secure mechanisms such as salted hashing. An attacker who gains access to the file system, database, or device memory can directly read authentication credentials without needing to crack them. The attack vector is network-based and does not require prior authentication or user interaction, although specific environmental conditions may be necessary for exploitation (AT:P).

An attacker can recover user authentication credentials (login and password) of the system and gain unauthorized access to sensitive functions and information managed by the OpenPLC V3 controller. Credential compromise in an industrial environment can lead to takeover of automation processes.

Apply patches available from the manufacturer according to references. Additionally, it is recommended to: isolate OT/ICS networks from corporate networks and the Internet, restrict access to the OpenPLC management interface to trusted hosts only, and monitor attempts of unauthorized access. Detailed recommendations are contained in the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10.

OpenPLC V3 Firmware and OpenPLC V3 (products: Openplcproject Openplc V3 Firmware, Openplcproject Openplc V3); specific versions indicated in manufacturer references and CISA ICS-CERT advisory ICSA-25-345-10.