CVE-2026-101022
MediumCVSS 4.3Summary
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
Risk Assessment
An attacker can map the internal network, which may facilitate further attacks on other systems and services.
Recommendation
It is recommended to restrict access to the Modbus feature, e.g., by filtering destination addresses or implementing an allowlist of hosts.
Other vulnerabilities in openPDC
See all- CVE-2026-85479Medium
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.
- CVE-2026-105281High
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.
- CVE-2026-105278Critical
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.
Original NVD description (English source)
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS