CVE-2026-35556
Plaintext Password Storage in OpenPLC_V3 Risks Credential Exposure
Publication date: 2026-04-09
Last updated on: 2026-04-16
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openplcproject | openplc_v3_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-256 | The product stores a password in plaintext within resources such as memory or files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in OpenPLC_V3 involves the plaintext storage of a password. This means that passwords are stored without encryption or hashing, making it possible for an attacker to retrieve these credentials easily.
Because the passwords are stored in plaintext, an attacker who gains access to the storage location can obtain sensitive information such as user credentials.
How can this vulnerability impact me? :
This vulnerability can have a severe impact because an attacker could retrieve stored credentials and gain unauthorized access to sensitive information or systems.
Such unauthorized access could lead to data breaches, manipulation of system operations, or further exploitation within the affected environment.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves plaintext storage of passwords, which could allow attackers to retrieve credentials and access sensitive information.
Storing passwords in plaintext is generally considered a poor security practice and can lead to non-compliance with common standards and regulations such as GDPR and HIPAA, which require protection of sensitive data and proper access controls.
Therefore, this vulnerability could negatively impact compliance with these regulations by exposing sensitive credentials and potentially sensitive information.