The vulnerability resides in the published Docker image for OpenPDC, which contains a hard‑coded administrative credential that cannot be changed upon first use. An attacker who can reach the management interface over the network can use that credential to authenticate and gain full administrative control of the application, potentially leading to configuration tampering, service disruption, or further compromise of the system. This flaw is consistent with the CWE-798 weakness: use of hard‑coded credentials.

Grid Protection Alliance’s openPDC Docker image is affected. No specific version range is listed in the CNA data, so all instances of the published image could be vulnerable until a patched version is released.

The CVSS score of 9.3 reflects a high‑severity vulnerability with full administrative privileges that can be achieved via the network. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs network access to the management interface, making exploitation straightforward if that interface is exposed. The high CVSS score indicates a significant threat, particularly in production environments where the image is deployed without additional controls.