PT-2025-40294 · Unknown · Openplc V3

Renato Garreton · CVE-2025-54811 · Published 2025-10-01 · Updated 2025-10-02

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenPLC V3 (affected versions not specified)

Description A flaw exists in the enipThread function of OpenPLC V3 due to a missing return value. This can cause a crash when the server loop completes, resulting in an illegal ud2 instruction. An attacker can trigger this remotely without authentication by repeatedly starting the server or by causing the server to exit unexpectedly. Successful exploitation leads to a Denial of Service (DoS), halting the PLC runtime and any associated automation or control logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-758

Related Identifiers

CVE-2025-54811

Affected Products

Openplc V3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-54811 · Security Note
• https://github.com/thiagoralves/OpenPLC_v3 · Note
• https://twitter.com/dplastico/status/1973423367480025391 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1973645130339946792 · Twitter Post
• https://twitter.com/CVEnew/status/1973511869034836115 · Twitter Post
• https://t.me/CVEtracker/33887 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-273-05 · Note