OpenPLC V3 Denial-of-Service Vulnerability in ENIP Thread Function

A denial-of-service vulnerability has been identified in OpenPLC V3, specifically within the ENIP thread function. The issue arises from the absence of a return value, which causes the application to crash when the server loop concludes and execution encounters an illegal instruction. This vulnerability can be exploited remotely and without authentication, either by starting the same server multiple times or by causing the server to exit unexpectedly. The exploitation leads to a crash of the PLC runtime process, disrupting all automation or control logic managed by OpenPLC.

Impact

Exploitation of this vulnerability causes the OpenPLC runtime process to crash, halting all automation or control logic being managed by the application.

Remediation

Users are advised to update OpenPLC V3 to pull request #292 or later from the main GitHub repository.