OpenPLC_V3 stores configuration passwords in plain text, allowing an attacker to read these credentials and gain unauthorized access to sensitive data and control of the PLC environment. This flaw, identified as CWE‑256, represents a direct breach of confidentiality that could lead to full system compromise. The vulnerability enables an adversary to obtain credentials that can be reused or manipulated to elevate privileges within the PLC network.

All currently released versions of OpenPLC_V3 are potentially affected, as the CNA lists the product without specifying version restrictions. Any deployed instance running OpenPLC_V3 that retains its default storage mechanism for passwords is at risk.

The CVSS score of 9.2 categorizes this issue as Critical, indicating a high potential for impact. While EPSS data is not available, the lack of vendor mitigation and the End‑of‑Life status suggest that exploitation could be practical for attackers who achieve read access to the system’s configuration files, either through local compromise or compromised credentials. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed widespread exploitation yet, but the attack vector is likely local or through remote access to privileged accounts that can read the password file.