Threat Intelligence Database

The Grid Protection Alliance openPDC Docker image contains a critical vulnerability where a fixed administrative credential is included without requiring a forced change on first use. This allows an attacker with network access to the management interface to authenticate using the default credential and gain full administrative control of the application.

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

CVE-2026-85479 is a medium severity vulnerability in the Grid Protection Alliance openPDC product. The STTP-based data publisher component accepts network connections without requiring authentication by default. This allows an unauthenticated attacker on the network to connect and exchange data with the interface. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. There is no indication of a patch or fix available at this time.

CVE-2026-105281 is a vulnerability in the Grid Protection Alliance openPDC product where the internal data publisher accepts network connections without authentication by default. This allows an unauthenticated attacker to connect and retrieve the full device and measurement topology of the system. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. It has a high severity with a CVSS score of 7.5.

CVE-2026-100730 is a critical deserialization vulnerability in the Grid Protection Alliance openPDC and openHistorian products. It involves a service console interface that deserializes client-supplied data. On systems without Windows Authentication, this interface is accessible to unauthenticated network attackers, while on systems with Windows Authentication, attackers must already be authenticated. Successful exploitation could allow remote code execution with the privileges of the affected service account.