OpenPLC_V3: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CVE-2025-54811 is a high-severity reliance on undefined, unspecified, or implementation-defined behavior vulnerability in OpenPLC_V3, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists version pull request #292 as the first without the flaw, so updating OpenPLC_V3 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.21% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update OpenPLC_V3 to pull request #292 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| OpenPLC_V3 | OpenPLC_V3 | before pull request #292 | pull request #292 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Scored by CNA (hq.dhs.gov).
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 6.1 | Medium | CNA (hq.dhs.gov) |
| CVSS 3.1 | 7.1 | High | CNA (hq.dhs.gov) |
Official description
OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Other references
Other vulnerabilities in OpenPLC_V3
- 8.8 High severity
- 7.5 High severity
- 9.8 Critical severity
- 8.0 High severity
Recent Reliance on Undefined, Unspecified, or Implementation-Defined Behavior vulnerabilities
- 8.8 High severity
Spotted an error? Tell us.