CVE-2025-54811 - CVE House
Back to Database
Status published Medium CVE-2025-54811

OpenPLC_V3

Vulnerability Description

OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54811

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Renato Garreton of TryHackMe reported this vulnerability to CISA.

References

More from OpenPLC_V3

View All →
CVE-2025-13970
OpenPLC_V3 Cross-Site Request Forgery
High 7

Affected Vendor

Affected Software

OpenPLC_V3
Vulnerable Versions:
0

Timeline

Official Publish: October 1st, 2025
Last Modified: October 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-758

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.