Description
OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Autonomy | OpenPLC | OpenPLC v3 | — |
References
- ExploitDB-49803 exploit
- OpenPLC Project Official Homepage product
- OpenPLC v3 GitHub Repository product
- VulnCheck Advisory: OpenPLC 3 - Remote Code Execution third-party-advisory