CVE-2025-54811: OpenPLC_V3 Denial of Service Vulnerability

CVE-2025-54811 Overview

CVE-2025-54811 is a denial-of-service vulnerability in OpenPLC_V3, an open-source programmable logic controller (PLC) runtime. The flaw resides in the enipThread function, which lacks a return value. When the EtherNet/IP (ENIP) server loop terminates, execution falls through to an illegal ud2 instruction, crashing the process. An attacker can trigger the crash by starting the same server multiple times or by causing the server to exit unexpectedly. The result is a halt of the PLC runtime and all automation or control logic it manages. The issue is categorized under [CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior].

Critical Impact
A successful attack stops the OpenPLC runtime, halting industrial automation and control processes managed by the affected device.

Affected Products

OpenPLC_V3 runtime (see the GitHub OpenPLC Project)
Industrial control systems deploying OpenPLC_V3 as referenced in the CISA ICSA-25-273-05 Advisory

Discovery Timeline

2025-10-01 - CVE-2025-54811 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54811

Vulnerability Analysis

The defect lies in the enipThread function inside the OpenPLC_V3 EtherNet/IP server. The function is declared with a return type but contains no explicit return statement. When the server's main accept loop exits, control flow reaches the end of the function without returning a value. The compiler emits an illegal ud2 instruction at this location, which raises an undefined opcode exception and terminates the process. The crash stops the PLC runtime and all logic it controls.

Root Cause

The root cause is undefined behavior caused by a missing return value in a non-void function. The C/C++ standards leave the result of falling off the end of a value-returning function undefined. Modern compilers often place a ud2 trap at the unreachable code path. Any condition that causes enipThread to exit its inner loop, such as duplicate server initialization or an unexpected socket close, exposes this trap.

Attack Vector

The vulnerability is reachable by network clients interacting with the EtherNet/IP service exposed by OpenPLC_V3. An unauthenticated attacker can repeatedly start the ENIP server or force it to exit, triggering the crash path. No credentials or user interaction are required. Successful exploitation produces a denial-of-service condition that disables automation logic until the operator restarts the runtime. Technical details are referenced in the CISA ICSA-25-273-05 Advisory.

Detection Methods for CVE-2025-54811

Indicators of Compromise

Unexpected termination of the OpenPLC runtime process with SIGILL or illegal instruction signals in system logs
Repeated TCP connections to the EtherNet/IP service port (TCP/44818) followed by service restarts
Gaps in PLC scan cycle telemetry or sudden loss of Modbus/ENIP responses from the controller

Detection Strategies

Monitor process supervisor logs for repeated crashes and restarts of the openplc binary
Inspect network flow records for multiple short-lived ENIP sessions originating from a single source
Correlate operating system core dumps showing faults at the tail of enipThread with network events

Monitoring Recommendations

Enable verbose logging on the OpenPLC runtime to capture thread state transitions and server start events
Forward ICS network telemetry to a centralized analytics platform to identify scanning of TCP/44818
Alert on availability gaps between the PLC runtime and connected HMI or SCADA endpoints

How to Mitigate CVE-2025-54811

Immediate Actions Required

Restrict network access to the OpenPLC ENIP service (TCP/44818) using firewall rules or ICS network segmentation
Place OpenPLC_V3 hosts behind a demilitarized zone (DMZ) and block exposure to untrusted networks
Apply the principle of least privilege to operator workstations that can initiate ENIP sessions
Monitor the OpenPLC GitHub repository for upstream patches addressing the missing return value

Patch Information

At the time of publication, no official fixed release is referenced in the NVD entry. Operators should track the upstream OpenPLC_V3 repository and the CISA ICSA-25-273-05 Advisory for fix availability. A code-level remediation requires adding an explicit return value to the enipThread function and validating server lifecycle handling so the loop cannot exit into undefined behavior.

Workarounds

Disable the EtherNet/IP server in the OpenPLC runtime configuration if it is not required for operations
Configure a process supervisor (such as systemd with Restart=on-failure) to automatically restart the runtime after a crash, reducing downtime
Enforce ICS-CERT recommended defense-in-depth controls, including network isolation and secure remote access via VPN