CVE-2025-13970
High
Description
OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated attacker to trick a logged-in administrator into visiting a maliciously crafted link, potentially enabling unauthorized modification of PLC settings or the upload of malicious programs which could lead to significant disruption or damage to connected systems.
SeverityHigh
CVSS8.0
Exploit probability—
ProductOpenPLC_V3
PublishedDec 13, 2025
First seenDec 13, 2025
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- OpenPLC_V3 OpenPLC_V3pull request #310 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenPLC_V3 OpenPLC_V3 | v < pull request #310 | pull request #310 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.