CVE-2025-54811: OpenPLC_V3
OpenPLCV3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54811?
CVE-2025-54811 is considered to have a high severity due to the potential for remote execution and system crashes.
How do I fix CVE-2025-54811?
To fix CVE-2025-54811, update OpenPLC_V3 to a version that includes the changes from pull request #292.
What causes CVE-2025-54811?
CVE-2025-54811 is caused by the lack of a return value in the enipThread function, leading to a crash when an illegal instruction is executed.
Can CVE-2025-54811 be exploited remotely?
Yes, CVE-2025-54811 can be exploited remotely without authentication, making it particularly concerning for affected systems.
Which versions of OpenPLC are affected by CVE-2025-54811?
OpenPLC_V3 versions prior to pull request #292 are affected by CVE-2025-54811.