A heap-based buffer overflow in OpenPLC_v3 exposes industrial control software to potential memory corruption and service disruption.

The vulnerability exists in the getData() function within webserver/core/modbus_master. It is a heap-based buffer overflow that can be triggered by an authenticated attacker with low privileges.

Successful exploitation of this vulnerability could lead to arbitrary code execution or a crash of the OpenPLC service. Given the high CVSS score of 8.8, this represents a significant risk to operational technology environments where system availability and integrity are critical to industrial processes.

Immediate Action: Review the provided commit history in the references to identify the fix and monitor the vendor repository for an official release containing the patch.

Proactive Monitoring: Monitor system logs for unexpected crashes of the OpenPLC web server or anomalies in Modbus communication traffic that may indicate attempted exploitation.

Compensating Controls: Implement strict network segmentation to ensure the OpenPLC web interface is not exposed to untrusted networks, and enforce strong authentication to limit the number of users with access to the system.

Public Exploit Available: Unknown

Organizations utilizing OpenPLC_v3 must treat this vulnerability with high priority due to the potential for severe impact on industrial control systems. While an official patch release is pending, administrators should restrict access to the affected service and monitor for any signs of unauthorized interaction with the Modbus master component.