CVE-2021-47770 HIGH

CVE-2021-47770: OpenPLC 3 - Remote Code Execution

Vendor Autonomy
Product OpenPLC
Weakness CWE-94 · Code injection
Published January 21, 2026
Last update April 7, 2026

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution.

Key dates

02Disclosure timeline

January 21, 2026 CVE published
April 7, 2026 Record updated

Related vulnerabilities

04Related CVE