The vulnerability exists in the Modbus connection feature of Grid Protection Alliance’s openPDC, where an authenticated user can specify any destination IP and port for outgoing connections. Because no validation or filtering is performed, the server can reach any internal host, revealing which addresses are reachable to the caller. Repeated requests can allow an attacker to map the internal network topology. This is a server‑side request forgery that can result in internal network reconnaissance. The weakness corresponds to CWE‑918.

The affected software is the Grid Protection Alliance openHistorian and openPDC, including the Docker image of openPDC. No specific product version information is provided, so all installs of these products may be affected until a fix is released.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is missing, but the lack of a KEV listing suggests there is no confirmed exploitation currently available. An authenticated user can trigger the flaw via the Modbus interface, which the product exposes to internal or external users. Because the attack requires authentication and knowledge of the Modbus interface, the threat surface is limited to trusted users or compromised credentials, but internal reconnaissance could lead to more targeted attacks.