Openplcproject Openplc V3 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Openplcproject Openplc V3 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (12)

• CVE-2018-20818 — CVSS 9.8 (critical): A buffer overflow vulnerability was discovered in the OpenPLC controller, in the OpenPLC_v2 and OpenPLC_v3 versions. It occurs in the…
• CVE-2026-28205 — CVSS 9.8 (critical): OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain…
• CVE-2024-34026 — CVSS 9.0 (critical): A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3…
• CVE-2021-31630 — CVSS 8.8 (high): Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on…
• CVE-2026-35063 — CVSS 8.8 (high): OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete…
• CVE-2026-35556 — CVSS 7.5 (high): OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access…
• CVE-2024-36980 — CVSS 7.5 (high): An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3…
• CVE-2024-36981 — CVSS 7.5 (high): An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3…
• CVE-2024-39589 — CVSS 7.5 (high): Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3…
• CVE-2024-39590 — CVSS 7.5 (high): Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3…
• CVE-2026-31156 — CVSS 6.5 (medium): A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from…
• CVE-2024-37741 — CVSS 5.4 (medium): OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture.