Vulnerability · Published Oct 1, 2025 · Assigned by icscert

CVE-2025-54811OpenPLC_V3

High 7.1

In plain English

A high-severity security flaw in OpenPLC_V3 from OpenPLC_V3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 89.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.

Affected products (as reported)

Vendor	Product	Versions
OpenPLC_V3	OpenPLC_V3	0 – before pull request #292

Weakness: CWE-758 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

In plain English

Official description

Affected products (as reported)

References