Shriyans Sudhi

A request paper on JavaScript has been submitted to a conference but has not been published yet. It should be updated here once it is published.

<Toast>**Considering OpenPLC V3 is End of Life, either update to OpenPLC Runtime v4 or the fork patched by me can be used*: https://github.com/shriyanss/OpenPLC_V3**</Toast>

<small>*Provided without warranty</small>

- **CVE-2026-35556**
- **CVSS 4.0 Score**: 9.2 (Critical)
- **CVSS 4.0 Vector**: [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE(s)**: [CWE-256 Plaintext storage of a password](https://cwe.mitre.org/data/definitions/256.html)

# Official

## Description

OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.

## Remediation

OpenPLC_v3 is now considered to be end of life. Users are recommended to upgrade to OpenPLC Runtime v4 (https://github.com/autonomy-logic/openplc-runtime)

# Technical Details

The passwords from the Web UI are stored plaintext in the database file in the installation directory. The path to the database file in the installation directory is `werbserver/openplc.db`

# Timeline

**Date format**: `YYYY-MM-DD`

- **Discovery**: 2026-02-13
- **Reported**: 2026-02-14
- **Fixed**: 2026-02-19
- **Published**: 2026-04-25


OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. - Discovered by Shriyans Sudhi