A flaw in the service console interface of Grid Protection Alliance’s openPDC and openHistorian allows an attacker to submit a crafted data structure that is deserialized without proper validation. This can cause arbitrary object graphs to be materialized, potentially executing code under the privileges of the service account running the application. On installations that do not enforce Windows Authentication, the vulnerable endpoint is reachable by any network user, enabling remote code execution. When Windows Authentication is enabled, the attacker must be authenticated before reaching the endpoint, reducing the exposure but still permitting exploitation by legitimate users.

The vulnerability affects all releases of openPDC prior to version 2.9.482 and all releases of openHistorian prior to version 2.8.585. The vendor also lists a Docker image of openPDC that remains unpatched. These systems expose a service console API that, if not protected by authentication, is reachable from the network. Any deployment running an affected version, whether on a Windows server or other operating system, should be considered exposed.

The base CVSS score of 9.3 reflects a critical severity level. The EPSS score is currently not available, indicating that no public exploit probability has been reported. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw via a network connection to the service console endpoint; on non‑Windows‑Authenticated installations, no credentials are needed, while on Windows‑Authenticated installations, the attacker must have active authentication. Successful exploitation results in remote code execution with the rights of the service account, potentially compromising the entire host.