CVE-2025-53476
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted series of network connections can lead to the server not processing subsequent Modbus requests. An attacker can open a series of TCP connections to trigger this vulnerability.
Risk Assessment
An attacker can cause the OpenPLC server to stop processing Modbus requests, disrupting communication with industrial devices. This may result in downtime in automation and production processes.
Recommendation
Restrict network access to the OpenPLC ModbusTCP server to trusted addresses and network segments only. Monitor for unusual TCP connection patterns and apply vendor updates when available.
Other vulnerabilities in OpenPLC
See all- CVE-2026-88020Medium
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.
- CVE-2026-31156Medium
A path injection vulnerability exists in OpenPLC v3 (commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a). The binary compiled from glue_generator.cpp does not validate file path parameters from the command line, allowing an attacker to read arbitrary files.
Original NVD description (English source)
A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted series of network connections can lead to the server not processing subsequent Modbus requests. An attacker can open a series of TCP connections to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS