Missing Authentication Check in openPDC and openHistorian

Date Published: November 08, 2026

Affects: openPDC v2.9.500 and earlier, openHistorian v2.8.609 and earlier

Severity: Medium

Overview

A critical vulnerability has been identified in both openPDC and openHistorian, which allows a user with Viewer role to edit or add measurements and connect to MODBUS devices. The action is secured and can only be accessed by an authorized user with view privileges, reducing the attack surface.

Vulnerability Details

The vulnerability allows an attacker with view access to access and API endpoint enabling creation and updating measurements, as well as an endpoint connecting to MODBUS devices. In addition to establishing the MODBUS connection the user can write arbitrary coil or holding-register values via the MODBUS connection.

Impact

If successfully exploited, an attacker could:

Establish a MODBUS connection to a device and write arbitrary coil or holding-register values to the device.

Modify the configuration of existing devices by adding or updating existing measurements.

The severity of this vulnerability is medium since a successful attack requires viewer access to the system.

Mitigation/Remediation

GPA has added additional validation logic in openHistorian version 2.8.610 and later and openPDC version 2.9.501 and later.

In the meantime the following actions can prevent an attacker from exploiting this vulnerability:

Restrict system permissions: Apply the principle of least privilege to all users.

Ensure password complexity requirements are sufficient: In order to exploit this vulnerability an attacker may need access to an authenticated user account.

Monitor logs for unusual activity: Review database and application logs and field device configurations for attempts to exploit this vulnerability.

Disclaimer

The information provided in this advisory is provided "as is" and does not guarantee the security of systems. We strongly recommend that users apply patches as soon as they are available and follow best practices for securing systems against known vulnerabilities.

GPA credits Sharvil Shetty for identifying this vulnerability and supporting resolution of the issue.