OTPulse

OpenPLC Runtime v3

MonitorCVSS 6.1ICS-CERT ICSA-26-265-09Sep 22, 2026
Manufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

OpenPLC Runtime v3 contains a cross-site scripting (XSS) vulnerability in the web interface. An attacker can inject malicious scripts into the web interface that, when visited by an operator, steal the operator's session cookie. Using the stolen cookie, the attacker can issue commands to the PLC and control the physical processes it manages. OpenPLC v3 is end-of-life and will not receive security patches.

What this means
What could happen
An attacker could hijack a PLC operator's session and issue commands to change process parameters or stop operations on the PLC without the operator's knowledge or consent.
Who's at risk
Manufacturers and facilities operating OpenPLC v3 for process control in any sector should prioritize this issue. This affects anyone using OpenPLC to automate manufacturing processes, water treatment, or utility operations where an attacker gaining control of the PLC could disrupt production or safety-critical functions.
How it could be exploited
An attacker sends a crafted web request to the OpenPLC runtime web interface that injects malicious script. When an operator visits the interface, the attacker's script executes in the operator's browser, stealing their session cookie. Using the stolen cookie, the attacker can impersonate the operator and send commands directly to the PLC to alter setpoints, disable alarms, or halt processes.
Prerequisites
  • Network access to the OpenPLC web interface (typically HTTP/HTTPS)
  • An operator must visit the crafted link or malicious page while logged into the OpenPLC runtime
  • No special credentials required—the attacker reuses the hijacked session
remotely exploitablelow complexityno authentication required for the initial attackaffects control logic affecting physical operations
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
OpenPLC: 33Fix available
Remediation & Mitigation
0/3
Do now
0/1
WORKAROUNDRestrict network access to the OpenPLC web interface to only trusted engineering workstations and control systems using firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade to OpenPLC v4 or later
Long-term hardening
0/1
HARDENINGSegment the PLC network from the corporate IT network to limit attacker access to the web interface
View full CISA ICS-CERT advisory
API: /api/v1/advisories/367b1cef-f7d1-4282-a00f-c6d6f29b413f

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.