Shriyans Sudhi

- **Conference**: ASE 2026 (41st IEEE/ACM International Conference on Automated Software Engineering)
- **Track**: Research Papers
- **Dates**: October 12-16, 2026, Munich, Germany
- **Author**: Shriyans Sudhi
- **Corresponding Author**: <a href="https://yinxi.site" target="_blank" rel="noopener noreferrer">Yinxi Liu</a>

Accepted at ASE 2026. Full details: [conf.researchr.org/profile/ase-2026/shriyanssudhi](https://conf.researchr.org/profile/ase-2026/shriyanssudhi)


Research paper accepted at ASE 2026 (Research Papers track) on automated semantic recovery of post-compilation abstraction leaks in the web - Shriyans Sudhi

<Toast>**Considering OpenPLC V3 is End of Life, either update to OpenPLC Runtime v4 or the fork patched by me can be used*: https://github.com/shriyanss/OpenPLC_V3**</Toast>

<small>*Provided without warranty</small>

- **CVE-2026-35556**
- **CVSS 4.0 Score**: 9.2 (Critical)
- **CVSS 4.0 Vector**: [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE(s)**: [CWE-256 Plaintext storage of a password](https://cwe.mitre.org/data/definitions/256.html)

# Official

## Description

OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.

## Remediation

OpenPLC_v3 is now considered to be end of life. Users are recommended to upgrade to OpenPLC Runtime v4 (https://github.com/autonomy-logic/openplc-runtime)

# Technical Details

The passwords from the Web UI are stored plaintext in the database file in the installation directory. The path to the database file in the installation directory is `werbserver/openplc.db`

# Timeline

**Date format**: `YYYY-MM-DD`

- **Discovery**: 2026-02-13
- **Reported**: 2026-02-14
- **Fixed**: 2026-02-19
- **Published**: 2026-04-25


OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. - Discovered by Shriyans Sudhi

CVE-2026-35556: Plaintext storage of a password in OpenPLC_V3

- **Conference**: ASE 2026 (41st IEEE/ACM International Conference on Automated Software Engineering)
- **Track**: Research Papers
- **Dates**: October 12-16, 2026, Munich, Germany
- **Author**: Shriyans Sudhi

Accepted at ASE 2026. Full details: [conf.researchr.org/profile/ase-2026/shriyanssudhi](https://conf.researchr.org/profile/ase-2026/shriyanssudhi)


Research paper accepted at ASE 2026 (Research Papers track) on an LLM agent for logic-defined exposures in recovered JavaScript - Shriyans Sudhi