OTPulse

Grid Protection Alliance openPDC and openHistorian

Plan PatchCVSS 9.8ICS-CERT ICSA-26-281-02Oct 8, 2026
Energy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Grid Protection Alliance openPDC and openHistorian are vulnerable to unsafe deserialization in the Modbus TCP interface. An attacker with network access to the unprotected interface can send crafted serialized objects to achieve arbitrary code execution on the device. The vulnerability is caused by insufficient validation of serialized data (CWE-502) combined with missing authentication checks (CWE-306) and Server-Side Request Forgery vectors (CWE-918). Default configurations in versions prior to 2.9.482 (openPDC) and 2.8.585 (openHistorian) bind the Modbus interface to all network interfaces, making it accessible from untrusted networks. Systems using Windows Authentication are partially protected as they require prior authentication. The published Docker images do not contain the fix and are recommended against for production use.

What this means
What could happen
An attacker with network access to openPDC or openHistorian could run arbitrary code on the device, potentially allowing them to manipulate power grid data streams, alter measurement values sent to control systems, or interrupt data collection that operators rely on to monitor grid status.
Who's at risk
Energy utilities and grid operators using Grid Protection Alliance openPDC or openHistorian for synchrophasor data collection and historical archival should care. This impacts any phasor measurement unit (PMU) concentrator or historian that collects real-time grid telemetry and feeds it to control systems, whether deployed on-premises or in cloud containerized environments.
How it could be exploited
An attacker sends a crafted network request to the unprotected Modbus TCP interface (port 502 or similar) with serialized malicious objects. The application deserializes the payload without proper validation, allowing code execution. The attacker does not need credentials if the interface is bound to all network interfaces; if Windows Authentication is enabled, the attacker must already be authenticated to the system.
Prerequisites
  • Network access to the Modbus TCP interface (typically port 502 on openPDC/openHistorian device)
  • Device interface must be bound to accept connections from the attacker's network (not restricted to loopback)
  • No authentication required if Windows Authentication is not enabled; requires valid system credentials if Windows Authentication is in use
remotely exploitablelow complexityno authentication required (unless Windows Authentication enabled)affects grid measurement and control systemscritical CVSS score (9.8)
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (6)
4 with fix2 EOL
ProductAffected VersionsFix Status
openPDC <2.9.482<2.9.482Fix available
openPDC (Docker image) <2.9.482<2.9.482No fix (EOL)
openHistorian <2.8.585<2.8.585Fix available
openPDC <2.9.477<2.9.477Fix available
openPDC (Docker image) <2.9.477<2.9.477No fix (EOL)
openHistorian <2.8.580<2.8.580Fix available
Remediation & Mitigation
0/5
Do now
0/2
WORKAROUNDVerify and update the Modbus interface binding configuration to localhost/127.0.0.1 (loopback only) for existing installations; do not rely on automatic defaults during upgrade
HARDENINGDeploy firewall rules to restrict network access to Modbus TCP port 502 and block connections from untrusted networks and RFC 1918 private address ranges
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate openPDC to version 2.9.482 or later
HOTFIXUpdate openHistorian to version 2.8.585 or later
Mitigations - no patch available
0/1
The following products have reached End of Life with no planned fix: openPDC (Docker image) <2.9.482, openPDC (Docker image) <2.9.477. Apply the following compensating controls:
HARDENINGDo not use published Docker images in production; migrate to native installations or wait for Grid Protection Alliance to publish a Docker image fix
View full CISA ICS-CERT advisory
API: /api/v1/advisories/894578d1-9235-480b-a784-48b49cfc5a7b

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.