Threat database

The openPDC Docker image from Grid Protection Alliance contains a fixed administrative credential that is not forced to be changed on first use. This allows an attacker with network access to the management interface to authenticate with the default credential and gain full administrative control. The vulnerability affects versions prior to 2.9.477 and 2.9.482. It has a critical CVSS score of 9.8.

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

CVE-2026-85479 is a medium severity vulnerability in the Grid Protection Alliance openPDC product. The STTP-based data publisher component accepts network connections without requiring authentication by default. This allows an unauthenticated attacker on the network to connect and exchange data with the interface.

CVE-2026-105281 is a vulnerability in the Grid Protection Alliance openPDC product where the internal data publisher accepts network connections without authentication by default. This allows an unauthenticated attacker to connect remotely and retrieve the full device and measurement topology of the system. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. The CVSS 3.1 base score is 7.5, indicating high severity due to the ability to obtain sensitive configuration information without privileges.

CVE-2026-100730 is a critical deserialization vulnerability in Grid Protection Alliance's openPDC and openHistorian products. It involves a service console interface that deserializes client-supplied data. On systems without Windows Authentication, this interface is accessible to unauthenticated network attackers; with Windows Authentication, attackers must be authenticated. Exploitation could allow remote code execution with the privileges of the affected service account.