CVE-2024-36981 Denial of service in OpenPLC v3

What is CVE-2024-36981?

CVE-2024-36981 is a high-severity denial of service vulnerability in OpenPLC_v3, published on 18 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out-of-bounds read vulnerability exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality of OpenPLC_v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted network request can lead to denial of service. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.This is the final instance of the incorrect comparison.

Weakness: CWE-125

Which versions are affected by CVE-2024-36981?

It affects 1 product.

Products include Openplcproject Openplc V3 Firmware.

How do I fix CVE-2024-36981?

No fix has been published for CVE-2024-36981 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-36981 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36981 exists.

Other vulnerabilities in OpenPLC_v3

• CVE-2026-28205 Initialization of a resource with an insecure default in OpenPLC_V3 Critical 9.2
• CVE-2026-35556 Plaintext storage of a password in OpenPLC_V3 Critical 9.2
• CVE-2024-34026 Memory corruption in OpenPLC v3 Critical 9.0
• CVE-2021-31630 Command injection in n/a High 8.8
• CVE-2026-35063 Missing Authorization in OpenPLC_V3 High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m92x-f2xf-6w5q.