PT-2025-40533 · Autonomy Logic · Openplc Runtime

Eyodav · Published 2025-10-03 · Updated 2025-11-13 · CVE-2025-34226

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3

Description The software contains an input validation flaw in the /upload-program-action API endpoint. The epoch time parameter, when submitting program uploads, is not validated, potentially leading to corruption of the programs database. A successful exploit allows continued operation until a restart, at which point the runtime may fail to start due to database corruption, resulting in a denial of service. Recovery requires a complete rebase of the product.

Recommendations Update to a version that includes commit 095ee09 or commit 095ee09623dd229b64ad3a1db38a901a3772f6fc.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-664

CWE-20

Related Identifiers

CVE-2025-34226

Affected Products

Openplc Runtime

References · 6

• 🔥 https://openplc.discussion.community/post/persistant-dos-affecting-openplc-runtime-13722844 · Exploit
• https://github.com/thiagoralves/OpenPLC_v3/pull/297/commits/095ee09623dd229b64ad3a1db38a901a3772f6fc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-34226 · Security Note
• https://t.me/cveNotify/142752 · Telegram Post
• https://autonomylogic.com · Note
• https://vulncheck.com/advisories/openplc-runtime-v3-persistent-denial-of-service · Note