OpenPLC Runtime v3 Persistent DoS

published 2025-10-03 13 mo ago modified 2026-11-08 24 h ago also EUVD-2025-32488

cvss: 7.1; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epoch_time field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate until a restart; on restart the runtime can fail to start because of corrupted database entries, resulting in persistent denial of service requiring complete rebase of the product to recover. This vulnerability was remediated by commit 095ee09.

Patch / fix

links 1

github.com/thiagoralves/OpenPLC_v3#297 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 13 mo ago (2025-10-03)

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

openplc.discussion.community https://openplc.discussion.community/post/persistant-dos-affecting-openplc-runtime-13722844 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Autonomy Logic OpenPLC Runtime

Classification

Weakness

CWE-664 Improper Control of a Resource Through its Lifetime
CWE-20 Improper Input Validation

References

github.com /thiagoralves/OpenPLC_v3/pull/297/commits/095ee09623dd229b64ad3a1db38a901a3772f6fc
issue-tracking, patch
openplc.discussion.community /post/persistant-dos-affecting-openplc-runtime-13722844
issue-tracking, exploit
autonomylogic.com /
product
vulncheck.com /advisories/openplc-runtime-v3-persistent-denial-of-service
third-party-advisory

Sources

CVE List CVE-2025-34226
NVD CVE-2025-34226

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary