Command Injection Vulnerability in Open PLC Webserver by OpenPLC Project
CVE-2021-31630

8.8HIGH

Key Information:

Vendor

Openplcproject

Status
Openplc V3 Firmware
Vendor
CVE Published:
3 August 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 86%

What is CVE-2021-31630?

The Open PLC Webserver v3 is susceptible to a command injection vulnerability through the 'Hardware Layer Code Box' component on the '/hardware' page. This flaw enables remote attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of the system. Users of Open PLC Webserver should act promptly to mitigate risks associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2021-31630
Created by thewhiteh4t

CVE-2021-31630-HTB
Created by Hunt3r0x

CVE-2021-31630-OpenPLC_RCE
Created by hev0x

References

https://www.youtube.com/watch?v=l08DHB08Gow
x_refsource_MISC
https://packetstormsecurity.com/files/162563/OpenPLC-WebS...
x_refsource_MISC

EPSS Score

86% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • Vulnerability published

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.