Command Execution via Service Console Connection in openPDC and openHistorian

Date Published: July 25, 2026

Affects: openPDC v2.9.481 and earlier, openHistorian v2.8.584 and earlier

Severity: Medium

Overview

A criticial vulnerability has been identified in both openPDC and openHistorian, which allows an attacker to force server-side BinaryFormatter deserialization of an arbitrary object graph. This is an extension of CWE-502: Deserialization of Untrusted Data (https://cwe.mitre.org/data/definitions/805.html) This flaw can potentially lead to the posibility of remote code execution while impersonating the account of the openPDC or openhistorian service, allowing an attacker to execute unauthorized code on affected systems. While this vulnerability exists on both, Windows and Linux deployed Systems, System deployed on Windows require the attacker to be authenticated, reducing the attack surface.

Vulnerability Details

The vulnerability allows an attacker with access to the console port (default 8500) to complete remote code execution while impersonating the account of the openPDC or openhistorian service. In systems using Windows Authetication, this requires the user to be autheticated on the server. On Linux based systems WIndows authentication is disabled and this vulnerability can be exploited by an unauatheticated attacker.

Impact

If successfully exploited, an attacker could:

Execute arbitrary commands on the target system with the privileges of the affected application.

Potentially gain remote control of the affected system, compromising its integrity, confidentiality, and availability.

The severity of this vulnerability depends on the application configuration, but it could lead to a full system compromise in the most critical scenarios.

The severity of this vulnerability is significantly higher for linux based systems and systems with Windows authentication disabled.

Mitigation/Remediation

GPA has added additionalvalidation into serialization logic in openHistorian verion 2.8.585 and later and openPDC version 2.9.482 and later.

In the meantime the following actions can prevent an attacher from exploiting this vulnerability:

Use of windows authetication: Make use of integtation of Windows Authentication when possible.

Restrict system permissions: Apply the principle of least privilege by ensuring that the openPDC and openHistorian services run with minimal privileges to reduce the impact of a successful attack.

Ensure password complexity requirments are sufficent: In order to exploit this vulnerability an attacker may need access to an authenticated user account.

Monitor logs for unusual activity: Review system and application logs for signs of unauthorized file writes or attempts to exploit this vulnerability.

Make use of industry standard firewall. This vulnerability requires an attacker to access the service console port (default 8500). This port is only used for the service console and can be restricted to local use only.

Disclaimer

The information provided in this advisory is provided "as is" and does not guarantee the security of systems. We strongly recommend that users apply patches as soon as they are available and follow best practices for securing systems against known vulnerabilities.

GPA credits Shubham Raj - Cipher / Causal Security for identifying this vulnerability and supporting resolution of the issue.