SQL Injection via Device Scronym

Date Published: November 03, 2026

Affects: openPDC v2.9.495 and earlier, openHistorian v2.8.601 and earlier

Severity: Low

Overview

A critical vulnerability has been identified in both openPDC and openHistorian, which allows an attacker to insert a SQL command when setting the acronym of a PMU. This flaw can potentially lead to the possibility of SQL injection in the configuration database including deleting or modifying the configuration for a PMU. The endpoint is secured and can only be accessed by an authorized user with edit or administrative privileges, reducing the attack surface.

Vulnerability Details

The vulnerability allows an attacker with access to insert a SQL command into the acronym field when editing or setting up a device. This command may get executed any time a user views the devices. This would allow an authorized attacker modify the device or system configuration including DELETE devices. Any SQL commands are restricted to the configuration database of the server.

Impact

If successfully exploited, an attacker could:

Execute arbitrary SQL commands on the configuration database. This may include modifying or deleting system and device configuration.

Potentially gain remote control of the affected system, compromising its integrity, confidentiality, and availability.

The severity of this vulnerability is low since a successful attack requires administrator or editor access to the system.

Mitigation/Remediation

GPA has added additional validation logic in openHistorian version 2.8.602 and later and openPDC version 2.9.496 and later.

In the meantime the following actions can prevent an attacker from exploiting this vulnerability:

Restrict system permissions: Apply the principle of least privilege to all users.

Ensure password complexity requirements are sufficient: In order to exploit this vulnerability an attacker may need access to an authenticated user account.

Monitor logs for unusual activity: Review database and application logs for attempts to exploit this vulnerability.

Disclaimer

The information provided in this advisory is provided "as is" and does not guarantee the security of systems. We strongly recommend that users apply patches as soon as they are available and follow best practices for securing systems against known vulnerabilities.

GPA credits kta1kri for identifying this vulnerability and supporting resolution of the issue.