CVE-2026-105281

HIGHCVSS 7.5

Description

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

Timeline

Published:October 9th, 2026 2:17 PM

Last modified:October 11th, 2026 5:17 PM

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-306

References & Reports

Advisories, patches, and third-party reports

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02

Source: NIST NVD · Data may lag official sources by up to one minute