Vulnerability · Published Jan 21, 2026 · Assigned by VulnCheck
CVE-2021-47770OpenPLC 3 - Remote Code Execution
High 8.8
In plain English
A high-severity code injection in OpenPLC from Autonomy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 44.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-49803 exploit
- OpenPLC Project Official Homepage product
- OpenPLC v3 GitHub Repository product
- VulnCheck Advisory: OpenPLC 3 - Remote Code Execution third-party-advisory