CVE-2026-28205: OpenPLC V3 Auth Bypass Vulnerability

CVE-2026-28205 Overview

CVE-2026-28205 is an authentication bypass vulnerability in OpenPLC_V3, an open-source programmable logic controller (PLC) used in industrial control system (ICS) environments. The flaw stems from an Initialization of a Resource with an Insecure Default weakness [CWE-1188]. An unauthenticated remote attacker can reach an exposed API and gain access to the system without supplying valid credentials. Successful exploitation provides control over the PLC runtime, which manages physical processes in operational technology (OT) deployments. CISA published advisory ICSA-25-345-10 covering this issue.

Critical Impact
A network-based attacker can bypass authentication on the OpenPLC_V3 API and obtain control of the PLC runtime, threatening integrity and availability of dependent industrial processes.

Affected Products

OpenPLC Project OpenPLC_V3 firmware
OpenPLC Project OpenPLC_V3 hardware
Deployments exposing the OpenPLC_V3 API to untrusted networks

Discovery Timeline

2026-04-09 - CVE CVE-2026-28205 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-28205

Vulnerability Analysis

OpenPLC_V3 ships with an API resource that is initialized using insecure default settings. The defaults do not require authenticated callers, so the API accepts requests from any network-reachable client. An attacker who can route packets to the PLC management interface can invoke API endpoints normally reserved for authorized operators. This grants the attacker the ability to interact with the controller and influence the programs it executes. Because OpenPLC_V3 runs in ICS contexts, that interaction can translate into manipulation of physical processes such as motors, valves, or sensors. The weakness maps to [CWE-1188], which covers resources initialized to states that violate the intended security policy.

Root Cause

The root cause is the project's default configuration of the API resource. Authentication enforcement is not active out of the box, leaving the trust boundary undefined for newly provisioned devices. Operators who deploy OpenPLC_V3 without hardening the defaults inherit this exposure.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the API over TCP and submits requests directly to privileged endpoints. The CVSS v4.0 vector indicates high impact to integrity and availability of the vulnerable system and connected subsystems. No public proof-of-concept exploit is currently listed, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

No verified exploit code is available. Refer to the CISA ICS Advisory ICSA-25-345-10 for technical context.

Detection Methods for CVE-2026-28205

Indicators of Compromise

Unexpected API requests to OpenPLC_V3 management endpoints from non-administrative hosts.
PLC program uploads, starts, or stops that do not correlate with authorized engineering workstation activity.
New or modified ladder logic, structured text, or runtime configuration appearing outside change windows.
Outbound connections from the PLC host to unfamiliar external addresses following API access.

Detection Strategies

Inspect HTTP access logs on the OpenPLC_V3 host for API calls that lack a preceding successful authentication event.
Baseline normal engineering traffic to the PLC and alert on source addresses outside the approved management VLAN.
Monitor for changes to runtime state, including program switches and I/O overrides, using OT-aware network monitoring.

Monitoring Recommendations

Forward PLC host logs and network flows to a centralized analytics platform that supports OCSF-normalized ingestion.
Apply MITRE ATT&CK for ICS mappings, particularly techniques under Initial Access (T0883) and Execution (T0853), to detection content.
Alert on any reachability from IT segments to the PLC API port outside of approved jump host activity.

How to Mitigate CVE-2026-28205

Immediate Actions Required

Restrict access to the OpenPLC_V3 API to a dedicated management network using firewall rules or access control lists.
Place affected controllers behind a hardened jump host that enforces multi-factor authentication for operator access.
Audit existing OpenPLC_V3 deployments for changes to PLC programs and runtime configuration since the device was commissioned.
Disable or block the API endpoint on internet-facing devices until a vendor fix is applied.

Patch Information

No vendor patch URL is listed in the enriched CVE data at the time of writing. Review the CISA ICS Advisory ICSA-25-345-10 for the latest remediation guidance from the OpenPLC project and CISA.

Workarounds

Segment OpenPLC_V3 controllers onto an isolated OT network with no direct routing from corporate IT or the internet.
Require VPN access with strong authentication before allowing any engineering workstation to reach the PLC API.
Deploy a reverse proxy that enforces authentication and authorization in front of the OpenPLC_V3 API where direct code changes are not feasible.
Continuously review CISA ICS advisories for updated mitigation steps tied to ICSA-25-345-10.

bash

# Example: restrict OpenPLC_V3 API access to a single engineering workstation
# Replace 10.20.30.40 with the authorized host and eth0 with the PLC interface
iptables -A INPUT -i eth0 -p tcp --dport 8080 -s 10.20.30.40 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j DROP