PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28205 OpenPLC_V3 CVE debrief

OpenPLC_V3 contains an insecure default configuration vulnerability (CWE-1188) that enables authentication bypass via API access. The product is end-of-life; CISA recommends migrating to OpenPLC Runtime v4.

Vendor
OpenPLC_V3
Product
Unknown
CVSS
HIGH 8.9
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-11
Original CVE updated
2026-04-09
Advisory published
2025-12-11
Advisory updated
2026-04-09

Who should care

Organizations operating OpenPLC_V3 in industrial control or building automation environments, OT security teams, and asset owners responsible for PLC runtime security.

Technical summary

CVE-2026-28205 affects OpenPLC_V3, an open-source programmable logic controller runtime. The vulnerability stems from insecure default initialization of a resource, allowing an unauthenticated attacker to bypass authentication and gain system access via the API. The CVSS 3.1 score of 8.9 reflects network attack vector, high attack complexity, no privileges required, no user interaction, and changed scope with low confidentiality, high integrity, and high availability impact. OpenPLC_v3 is now end-of-life; users should upgrade to OpenPLC Runtime v4.

Defensive priority

HIGH

Recommended defensive actions

  • Migrate from OpenPLC_v3 to OpenPLC Runtime v4 as the v3 branch is end-of-life and will not receive security updates.
  • Review and harden API authentication configurations on any remaining OpenPLC_v3 instances prior to migration.
  • Apply network segmentation and access controls to limit exposure of OpenPLC management interfaces.
  • Monitor ICS-CERT and CISA advisories for additional guidance on industrial control system security practices.

Evidence notes

CISA ICS advisory ICSA-25-345-10 (Update A, 2026-04-09) confirms OpenPLC_v3 is end-of-life and documents the insecure default leading to authentication bypass. CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H yields base score 8.9 (HIGH).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28205 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28205

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28205 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28205

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-345-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.