CVE-2021-47770
OpenPLC 3 - Remote Code Execution
- State
- Published
- Severity
- 8.6 High
- Published
- Jan 21, 2026
- Updated
- Aug 14, 2026
- Reserved
- Jan 14, 2026
Description
OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
OpenPLCAutonomy |
|
References
- ExploitDB-49803exploit
- OpenPLC Project Official Homepageproduct
- OpenPLC v3 GitHub Repositoryproduct
- VulnCheck Advisory: OpenPLC 3 - Remote Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.