OpenPLC_v3 contains a heap‑based buffer overflow in the getData() function of the Modbus Master component. The function copies input data frame characters between two delimiters into a caller‑supplied buffer without a size limit or bounds check. In the normal operation the buffer is the 100‑byte heap‑allocated MB_device.dev_name field. An attacker can send an oversized device_name value, which is stored in mbconfig.cfg and reloaded at startup. The overflow overwrites adjacent fields (protocol, dev_address, ip_port) and corrupts the heap, causing the PLC process control loop to crash. The result is a denial of Service and uncontrolled modification of configuration data.

This vulnerability affects all installations of OpenPLC_v3 that use the webserver and Modbus Master features. No specific version numbers are listed, so any released build of OpenPLC_v3 is potentially impacted. The failure occurs when the web interface is accessed with a payload that exceeds 100 bytes in the device_name field. Products not containing the Modbus Master component or using OpenPLC Runtime v4 are not affected.

The CVSS score is 8.7, indicating high severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access to the OpenPLC web interface; based on the description, it is inferred that the attacker must send a crafted HTTP POST to the /modbus endpoint. Successful exploitation would result in a runtime crash and tampering of configuration fields. Given the limited attack surface and low exploitation probability, the risk is high severity but low current threat level.