Executive brief
OpenPLC Runtime v3 is a programmable logic controller used to automate critical infrastructure processes in manufacturing, energy, transportation, and water systems. A cross-site scripting (XSS) vulnerability in the web interface allows attackers to inject malicious code that can hijack operator session cookies and issue unauthorized commands, potentially giving an attacker full control over physical processes managed by the controller.
Technical details
The vulnerability is an improper neutralization of input during web page generation (CWE-79, cross-site scripting) affecting OpenPLC Runtime v3. The web interface fails to encode user-supplied input from query string parameters when routing program requests, allowing an attacker to inject arbitrary JavaScript code. The attack requires user interaction (a victim must click a malicious link), but no authentication is needed. Successful exploitation enables an attacker to steal session cookies belonging to authenticated operators and issue state-changing requests with their privileges, resulting in full control over the programmable logic controller and its connected physical processes. Autonomy Logic has end-of-lifed OpenPLC v3 and recommends upgrading to OpenPLC v4, which is the only remediation path available.
Affected products
- Autonomy Logic OpenPLC Runtime v3 v3 6.1
Timeline
- 2026-09-22: disclosed