Executive brief
OpenPLC_v3, a software-based Programmable Logic Controller (PLC) used in industrial automation, is vulnerable to a memory corruption flaw. An authenticated user can submit a specially crafted device name through the web interface that crashes the PLC's control loop and overwrites internal configuration settings. This could lead to a complete shutdown of industrial processes or unauthorized changes to how the controller communicates with other hardware.
Technical details
A heap-based buffer overflow (CWE-122) exists in the getData() function in webserver/core/modbus_master.cpp. The function reads characters between delimiters into a caller-supplied buffer without performing bounds checking. When called by parseConfig(), it targets the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker can send a crafted HTTP POST request to the /modbus endpoint with a device_name exceeding 99 characters. This value is persisted to mbconfig.cfg and, upon loading, overflows the heap buffer, overwriting adjacent struct fields such as protocol, dev_address, and ip_port. This results in heap corruption and a crash of the PLC process control loop. The upstream repository is archived, and no fix is expected for v3, though v4 is reportedly unaffected.
Affected products
- openplcproject OpenPLC_v3 All versions up to commit b4702061dc14d1024856f71b4543298d77007b88
Timeline
- 2026-04-04: other: Upstream repository archived by owner
- 2026-06-24: disclosed: Vulnerability reported by Shuhratbek Uraimov
- 2026-07-18: advisory: NVD publication date