CVE-2025-34226
BaseFortify
Publication date: 2025-10-03
Last updated on: 2025-11-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| autonomy | openplc_runtime | 3 |
| autonomy | openplc_runtime | 3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-664 | The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an input validation flaw in OpenPLC Runtime v3's /upload-program-action endpoint. Specifically, the epoch_time field provided during program uploads is not properly validated, allowing an attacker to craft a malformed input that corrupts the programs database. Although the runtime continues to operate after the malformed upload, it may fail to start after a restart due to the corrupted database, causing a persistent denial of service that requires a complete rebase of the product to recover.
How can this vulnerability impact me? :
The impact of this vulnerability is a persistent denial of service. After a successful malformed upload, the OpenPLC Runtime may continue running until it is restarted. Upon restart, the runtime can fail to start because of corrupted database entries, making the system unavailable until a full rebase of the product is performed to recover.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid uploading programs with crafted or malformed epoch_time fields to the /upload-program-action endpoint. Apply the patch that remediated the issue, specifically the commit 095ee09623dd229b64ad3a1db38a901a3772f6fc. Additionally, monitor for any signs of database corruption and be prepared to rebase the product if a restart failure occurs due to corrupted database entries.