OpenPLC_V3 Cross-Site Request Forgery
Platform
other
Component
openplc_v3
Opgelost in
pull request #310
CVE-2025-13970 describes a cross-site request forgery (CSRF) vulnerability affecting OpenPLC_V3. This flaw allows an attacker to exploit logged-in administrators by crafting malicious links, leading to unauthorized actions. The vulnerability impacts versions prior to pull request #310, and a fix is available in pull request #310.
Impact en Aanvalsscenarioswordt vertaald…
The CSRF vulnerability in OpenPLC_V3 poses a significant risk to systems relying on PLC automation. An attacker can leverage this flaw to trick an authenticated administrator into performing actions they did not intend. This could involve modifying PLC settings, uploading malicious programs, or executing arbitrary commands within the PLC environment. Successful exploitation could lead to disruption of industrial processes, damage to equipment, or even safety hazards, depending on the PLC's role in the system. The potential impact is amplified if the PLC controls critical infrastructure or safety-critical functions.
Uitbuitingscontextwordt vertaald…
CVE-2025-13970 was publicly disclosed on 2025-12-13. No public proof-of-concept (PoC) code has been released at the time of writing. The EPSS score is pending evaluation, but the HIGH CVSS score suggests a moderate probability of exploitation. It is not currently listed on the CISA KEV catalog.
Wie Loopt Risicowordt vertaald…
Organizations utilizing OpenPLC_V3 in industrial automation, particularly those with remote access to PLC configuration interfaces, are at risk. Legacy deployments with weak authentication practices or shared hosting environments are especially vulnerable.
Aanvalstijdlijn
- Disclosure
disclosure
Dreigingsinformatie
Exploit Status
EPSS
0.02% (5% percentiel)
CISA SSVC
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Hoog — vereist een race condition, niet-standaard configuratie of specifieke omstandigheden.
- Privileges Required
- Geen — geen authenticatie vereist om te exploiteren.
- User Interaction
- Vereist — slachtoffer moet een bestand openen, op een link klikken of een pagina bezoeken.
- Scope
- Gewijzigd — aanval kan voorbij het kwetsbare component uitbreiden naar andere systemen.
- Confidentiality
- Geen — geen vertrouwelijkheidsimpact.
- Integrity
- Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
- Availability
- Hoog — volledige crash of uitputting van resources. Totale denial of service.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gereserveerd
- Gepubliceerd
- Gewijzigd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2025-13970 is to upgrade OpenPLC_V3 to the version incorporating pull request #310, which includes the necessary CSRF validation. If immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to PLC configuration interfaces, enforcing multi-factor authentication for administrative accounts, and carefully scrutinizing any links received via email or other external sources. Implementing a Web Application Firewall (WAF) with CSRF protection rules can also provide an additional layer of defense. After upgrading, confirm the fix by attempting to trigger a PLC configuration change via a crafted URL; the request should be rejected due to CSRF protection.
Hoe te verhelpen
Werk OpenPLC_V3 bij naar een versie later dan pull request #310. Dit corrigeert de CSRF kwetsbaarheid door de juiste CSRF validatie te implementeren. Raadpleeg de OpenPLC_V3 GitHub repository voor de meest recente versie en update instructies.
CVE Beveiligingsnieuwsbrief
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
Veelgestelde vragenwordt vertaald…
What is CVE-2025-13970 — CSRF in OpenPLC_V3?
CVE-2025-13970 is a cross-site request forgery (CSRF) vulnerability in OpenPLC_V3, allowing attackers to trick administrators into unauthorized actions.
Am I affected by CVE-2025-13970 in OpenPLC_V3?
You are affected if you are using OpenPLC_V3 prior to pull request #310.
How do I fix CVE-2025-13970 in OpenPLC_V3?
Upgrade to the version incorporating pull request #310 to resolve the vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
Is CVE-2025-13970 being actively exploited?
No active exploitation has been confirmed at this time, but the HIGH CVSS score warrants caution.
Where can I find the official OpenPLC advisory for CVE-2025-13970?
Refer to the OpenPLC project's official communication channels and repositories for the latest advisory regarding CVE-2025-13970.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.