CVE-2025-54811
📋 TL;DR
OpenPLC_V3 has a remote unauthenticated denial-of-service vulnerability in its enipThread function. Attackers can crash the PLC runtime by triggering an illegal instruction, halting all automation and control logic. This affects all systems running vulnerable versions of OpenPLC_V3.
💻 Affected Systems
- OpenPLC_V3
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete shutdown of industrial control processes, causing production stoppage, safety system failures, or environmental incidents.
Likely Case
Temporary disruption of PLC operations requiring manual restart and potential process downtime.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Simple remote trigger via starting server multiple times or causing unexpected exit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub repository for latest patched version
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05
Restart Required: Yes
Instructions:
1. Check OpenPLC_V3 GitHub repository for latest release
2. Update to patched version
3. Restart OpenPLC service
4. Verify functionality
🔧 Temporary Workarounds
Network Segmentation
allIsolate OpenPLC systems from untrusted networks
Access Control
linuxImplement firewall rules to restrict access to OpenPLC ports
sudo ufw deny 44818/tcp
sudo ufw deny 44818/udp
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PLC from untrusted networks
- Deploy intrusion detection monitoring for abnormal PLC restarts/crashes
🔍 How to Verify
Check if Vulnerable:
Check if OpenPLC_V3 crashes when server is started multiple times or exits unexpectedlyCheck Version:
Check OpenPLC web interface or run with --version flagVerify Fix Applied:
Test that server no longer crashes under the same conditions📡 Detection & Monitoring
Log Indicators:
- Unexpected PLC process termination
- Server restart events
- Illegal instruction errors in system logs
Network Indicators:
- Multiple connection attempts to port 44818
- Abnormal ENIP/CIP traffic patterns
SIEM Query:
source="openplc.log" AND ("crash" OR "terminated" OR "illegal instruction")