CVE-2026-28205
Insecure Default Initialization in OpenPLC_V3 Enables Authentication Bypass
Publication date: 2026-04-09
Last updated on: 2026-04-28
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openplcproject | openplc_v3_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in OpenPLC_V3 is an Initialization of a Resource with an Insecure Default. This means that the system is set up with insecure default settings that allow an attacker to bypass authentication mechanisms.
Specifically, an attacker could exploit this weakness via an API to gain unauthorized access to the system.
How can this vulnerability impact me? :
This vulnerability can have a severe impact because it allows an attacker to bypass authentication and gain unauthorized access to the system.
Such unauthorized access could lead to control or manipulation of the system, potentially causing operational disruptions or exposing sensitive information.