CVE-2025-13970 - CVE House
Back to Database
Status published High CVE-2025-13970

OpenPLC_V3 Cross-Site Request Forgery

Vulnerability Description

OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settings or the upload of malicious programs which could lead to significant disruption or damage to connected systems.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13970

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Muhammad Ali and Anthony Marrongelli of University of Central Florida (UCF) reported this vulnerability to CISA.

References

More from OpenPLC_V3

View All →
CVE-2025-54811
OpenPLC_V3
Medium 6.1

Affected Vendor

Affected Software

OpenPLC_V3
Vulnerable Versions:
0

Timeline

Official Publish: December 13th, 2025
Last Modified: December 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact