# OpenPLC_V3 denial-of-service via undefined behavior crash

Published: 2025-09-30 · Severity: routine · Sectors: manufacturing, energy, transportation, infrastructure
Canonical: https://vorant.io/reports/29ba7da9-4682-5209-8cad-12cf341c62cc/openplc-v3-denial-of-service-via-undefined-behavior-crash

> OpenPLC_V3 crash vulnerability allows local denial of service against PLC runtime; patch via pull request #292.

OpenPLC_V3 versions prior to pull request #292 contain a vulnerability in the enipThread function due to missing return value handling, leading to execution of an illegal ud2 instruction when the server loop ends. An attacker with local access or triggering server exit conditions can crash the PLC runtime process, halting all automation and control logic managed by the system. The vulnerability (CVE-2025-54811) has a CVSS v3.1 score of 7.1 and v4 score of 6.1, with low attack complexity and no authentication required.

The flaw is not remotely exploitable and no public exploitation has been reported to date. The vulnerability affects critical infrastructure sectors including manufacturing, energy, transportation, and water systems worldwide. Mitigation requires updating to pull request #292 or later from the OpenPLC GitHub repository. CISA recommends minimizing network exposure, isolating control system networks behind firewalls, and using VPNs for required remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-54811

## Detection guidance (public sample)

### OpenPLC Runtime Crash With Invalid Opcode Trap

ATT&CK: T1499

Kernel log shows an invalid opcode (ud2) trap in an OpenPLC runtime process, the crash condition of CVE-2025-54811 in enipThread. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OpenPLC Runtime Crash With Invalid Opcode Trap
id: 51f1dfaf-f359-5670-afb0-e3552358dd7b
status: experimental
description: Detects kernel log messages reporting an invalid opcode trap (ud2 / SIGILL)
  in a process whose name contains openplc. This matches the CVE-2025-54811 crash,
  where the enipThread server loop ends without a return value and falls into an illegal
  ud2 instruction, killing the PLC runtime.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05
tags:
- attack.impact
- attack.t1499
logsource:
  product: linux
  service: syslog
detection:
  keywords_trap:
  - trap invalid opcode
  - 'invalid opcode:'
  keywords_proc:
  - openplc
  - OpenPLC
  condition: keywords_trap and keywords_proc
falsepositives:
- Faulty hardware or an unsupported CPU instruction set while testing custom OpenPLC
  builds
- Developers debugging the OpenPLC runtime with crash-inducing test cases
level: medium
author: Vorant
```

### OpenPLC Process Abnormal Termination With SIGILL

ATT&CK: T1499

Auditd records an abnormal end (ANOM_ABEND) of an OpenPLC process from signal 4 (illegal instruction), indicating the runtime has crashed and automation logic has stopped. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OpenPLC Process Abnormal Termination With SIGILL
id: 20211575-5154-57ff-a940-f8a4f19b78b9
status: experimental
description: Detects auditd ANOM_ABEND events where an OpenPLC process terminated
  on signal 4 (SIGILL, illegal instruction). This is the observable result of the
  CVE-2025-54811 ud2 crash in the enipThread function, which halts PLC runtime control
  logic.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05
tags:
- attack.impact
- attack.t1499
logsource:
  product: linux
  service: auditd
detection:
  selection_event:
    type: ANOM_ABEND
    sig: 4
  selection_proc:
  - comm|contains: openplc
  - exe|contains: openplc
  condition: selection_event and selection_proc
falsepositives:
- Lab or test crashes of OpenPLC during development or fuzzing
- Running the runtime on hardware that lacks required CPU features
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-273-05

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/29ba7da9-4682-5209-8cad-12cf341c62cc/openplc-v3-denial-of-service-via-undefined-behavior-crash.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup