OpenPLC_V3 denial-of-service via undefined behavior crash
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
OpenPLC_V3 crash vulnerability allows local denial of service against PLC runtime; patch via pull request #292.
OpenPLC_V3 versions prior to pull request #292 contain a vulnerability in the enipThread function due to missing return value handling, leading to execution of an illegal ud2 instruction when the server loop ends. An attacker with local access or triggering server exit conditions can crash the PLC runtime process, halting all automation and control logic managed by the system. The vulnerability (CVE-2025-54811) has a CVSS v3.1 score of 7.1 and v4 score of 6.1, with low attack complexity and no authentication required.
The flaw is not remotely exploitable and no public exploitation has been reported to date. The vulnerability affects critical infrastructure sectors including manufacturing, energy, transportation, and water systems worldwide. Mitigation requires updating to pull request #292 or later from the OpenPLC GitHub repository. CISA recommends minimizing network exposure, isolating control system networks behind firewalls, and using VPNs for required remote access.
Mentioned in this report
Detection guidance
OpenPLC Runtime Crash With Invalid Opcode Trap
Kernel log shows an invalid opcode (ud2) trap in an OpenPLC runtime process, the crash condition of CVE-2025-54811 in enipThread. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenPLC Runtime Crash With Invalid Opcode Trap id: 51f1dfaf-f359-5670-afb0-e3552358dd7b status: experimental description: Detects kernel log messages reporting an invalid opcode trap (ud2 / SIGILL) in a process whose name contains openplc. This matches the CVE-2025-54811 crash, where the enipThread server loop ends without a return value and falls into an illegal ud2 instruction, killing the PLC runtime. references: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05 tags: - attack.impact - attack.t1499 logsource: product: linux service: syslog detection: keywords_trap: - trap invalid opcode - 'invalid opcode:' keywords_proc: - openplc - OpenPLC condition: keywords_trap and keywords_proc falsepositives: - Faulty hardware or an unsupported CPU instruction set while testing custom OpenPLC builds - Developers debugging the OpenPLC runtime with crash-inducing test cases level: medium author: Vorant
OpenPLC Process Abnormal Termination With SIGILL
Auditd records an abnormal end (ANOM_ABEND) of an OpenPLC process from signal 4 (illegal instruction), indicating the runtime has crashed and automation logic has stopped. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenPLC Process Abnormal Termination With SIGILL
id: 20211575-5154-57ff-a940-f8a4f19b78b9
status: experimental
description: Detects auditd ANOM_ABEND events where an OpenPLC process terminated
on signal 4 (SIGILL, illegal instruction). This is the observable result of the
CVE-2025-54811 ud2 crash in the enipThread function, which halts PLC runtime control
logic.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05
tags:
- attack.impact
- attack.t1499
logsource:
product: linux
service: auditd
detection:
selection_event:
type: ANOM_ABEND
sig: 4
selection_proc:
- comm|contains: openplc
- exe|contains: openplc
condition: selection_event and selection_proc
falsepositives:
- Lab or test crashes of OpenPLC during development or fuzzing
- Running the runtime on hardware that lacks required CPU features
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs