CVE-2024-34026 Memory corruption in OpenPLC v3

What is CVE-2024-34026?

CVE-2024-34026 is a critical memory corruption vulnerability in OpenPLC_v3, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted EtherNet/IP request can lead to remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2024-34026?

It affects 1 product.

Products include Openplcproject Openplc V3 Firmware.

How do I fix CVE-2024-34026?

No fix has been published for CVE-2024-34026 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-34026 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34026 exists.

Other vulnerabilities in OpenPLC_v3

• CVE-2026-28205 Initialization of a resource with an insecure default in OpenPLC_V3 Critical 9.2
• CVE-2026-35556 Plaintext storage of a password in OpenPLC_V3 Critical 9.2
• CVE-2021-31630 Command injection in n/a High 8.8
• CVE-2026-35063 Missing Authorization in OpenPLC_V3 High 8.7
• CVE-2024-36980 Denial of service in OpenPLC v3 High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fxq3-rjrf-gqq3.