PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35556 OpenPLC_V3 CVE debrief

OpenPLC_V3 contains a Plaintext Storage of a Password vulnerability (CWE-256) that allows credential retrieval and unauthorized access to sensitive information. The product is now end-of-life with no patches planned; CISA directs users to migrate to OpenPLC Runtime v4.

Vendor
OpenPLC_V3
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-11
Original CVE updated
2026-04-09
Advisory published
2025-12-11
Advisory updated
2026-04-09

Who should care

Organizations operating industrial control systems with OpenPLC_v3 deployments, particularly those in critical infrastructure sectors where PLC security affects physical processes. Priority should be given to internet-facing or poorly segmented installations.

Technical summary

OpenPLC_V3 stores passwords in plaintext, enabling attackers with file system or backup access to recover credentials and gain unauthorized access to the runtime environment. The vulnerability is rated CVSS 3.1 8.1 (High) with attack vector Network, attack complexity High, and impacts Confidentiality, Integrity, and Availability. No patches are available as the product is end-of-life; migration to OpenPLC Runtime v4 is the prescribed remediation.

Defensive priority

HIGH

Recommended defensive actions

  • Migrate from OpenPLC_v3 to OpenPLC Runtime v4 as the affected version is end-of-life with no security patches available.
  • Audit systems for any remaining OpenPLC_v3 deployments and prioritize replacement based on exposure to untrusted networks.
  • Review and rotate any credentials that may have been stored or transmitted by OpenPLC_v3 instances.
  • Apply network segmentation and access controls to limit exposure of remaining OpenPLC_v3 instances until migration is complete.
  • Monitor for unauthorized access attempts targeting OpenPLC_v3 administrative interfaces.

Evidence notes

CISA published ICSA-25-345-10 on 2025-12-11 and updated it on 2026-04-09 (Update A) to revise mitigations and add CVE references. The advisory confirms OpenPLC_v3 is end-of-life and recommends upgrading to OpenPLC Runtime v4. SSVC scoring indicates Exploitation: None, Automatable: No.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35556 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35556

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35556 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35556

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-345-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.