CVE-2021-47770

HIGH 8.8

OpenPLC 3 - Remote Code Execution

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution.

CWE	CWE-94
Vendor	autonomy
Product	openplc
Published	Jan 21, 2026
Last Updated	Apr 7, 2026

Stay Ahead of the Next One

Get instant alerts for autonomy openplc

Be the first to know when new high vulnerabilities affecting autonomy openplc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Autonomy / OpenPLC

OpenPLC v3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/49803 openplcproject.com: https://www.openplcproject.com/ github.com: https://github.com/thiagoralves/OpenPLC_v3 vulncheck.com: https://www.vulncheck.com/advisories/openplc-remote-code-execution

Credits

Fellipe Oliveira