CyberRota Analysis
AI-GeneratedThe OpenPLC Runtime v3 is vulnerable due to its compile_program() function, which allows attackers to exploit the parsing of `(*FILE:path content*)` directives in Structured Text (.st) files, enabling arbitrary file writes outside the intended directory. This flaw can lead to remote code execution, particularly through the manipulation of system files like cron jobs or SSH authorized_keys, especially when combined with the use of hardcoded default credentials. Organizations using OpenPLC should prioritize patching this vulnerability to mitigate the risk of unauthorized access and potential system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.