CVE-2026-35556Disclosure(openplcproject / openplc_v3)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.

openplcproject CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10

Weakness type (CWE)

CWE-256

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openplc_v3
openplc_v3_firmware

Threat summary

Public PoC is present in monitored signal
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-04-10); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

openplcproject

Products

openplc_v3openplc_v3_firmware

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

PoC

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-09	1	Disclosure1
2026-04-10	2	Disclosure1General1
2026-04-11	1	PoC1

Full discourse4 posts

0day Signal@0dayPublishing181d
Disclosure
🚨 CVE-2026-35556: Plaintext storage of a password ... Industrial control systems storing passwords in plaintext is asking for a breach - one config file dump and your entire... https://zerodaysignal.com/vulnerability/CVE-2026-35556 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE‑2026‑35556, noting that industrial control systems store passwords in plain text, but no proof‑of‑concept, exploit, or patch information is included.
0001156
204 followersView on X
Shriyans Sudhi@ss0x00180d
PoC
Got a few CVEs during a random past-midnight code audit: CVE-2026-28205, CVE-2026-35556 CISA Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10 Technical details with exploitation steps: https://ss0x00.com/research #infosec #cve
Post summary
The post references CVE‑IDs and links to a page with exploitation steps, but it does not provide explicit PoC code, exploit tools, or active exploitation details.
0000099
495 followersView on X
CCB Alert@CCBalert182d
General
Warning: Multiple Critical vulnerabilities in #OpenPLC_V3, among others CVE-2026-35556 CVSS: 9.2. These can allow attackers to bypass authentication on the API, alter PLC settings and retrieve the plaintext passwords. More info: https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10 #Patch #Patch #Patch
Post summary
The tweet warns of a critical authentication bypass vulnerability (CVE‑2026‑35556) in OpenPLC_V3 that allows attackers to change PLC settings and read stored passwords, referencing a CISA advisory but providing no PoC, exploit code, patch details, or evidence of active exploitation.
00000223
7.2K followersView on X
CVE@CVEnew182d
Disclosure
CVE-2026-35556 OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. https://www.cve.org/CVERecord?id=CVE-2026-35556
Post summary
CVE-2026-35556 exposes a plaintext password storage flaw in OpenPLC_V3 that permits attackers to recover credentials and access sensitive data, but no exploitation or repair details are provided.
00000145
57.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	openplcproject	openplc_v3	-	-	-
OS	openplcproject	openplc_v3_firmware	-	-	-

Explore more

Back to dashboard openplcproject CVEs openplc_v3 vulnerabilities

What researchers are saying

CVE-2026-35556

0day Signal@0dayPublishingDisclosure

The post announces CVE‑2026‑35556, noting that industrial control systems store passwords in plain text, but no proof‑of‑concept, exploit, or patch information is included.

Shriyans Sudhi@ss0x00PoC

The post references CVE‑IDs and links to a page with exploitation steps, but it does not provide explicit PoC code, exploit tools, or active exploitation details.

CCB Alert@CCBalertGeneral

The tweet warns of a critical authentication bypass vulnerability (CVE‑2026‑35556) in OpenPLC_V3 that allows attackers to change PLC settings and read stored passwords, referencing a CISA advisory but providing no PoC, exploit code, patch details, or evidence of active exploitation.

CVE@CVEnewDisclosure

CVE-2026-35556 exposes a plaintext password storage flaw in OpenPLC_V3 that permits attackers to recover credentials and access sensitive data, but no exploitation or repair details are provided.