The STTP-based data publisher on openPDC accepts network connections without any form of authentication in its default configuration. As a result an attacker who can reach the interface may connect and exchange data, potentially reading sensitive measurement streams or injecting false data, thereby compromising the confidentiality, integrity, and availability of the monitored process. The weakness is a missing authentication mechanism (CWE‑306).

This issue affects Grid Protection Alliance products: openHistorian, openPDC, and the openPDC Docker image. No specific version details are provided, so any installation matching those product names with the default STTP configuration may be vulnerable.

The associated CVSS score of 6.9 indicates medium severity, while no EPSS value is available and the vulnerability is not listed in CISA KEV. Since the interface listens on all network interfaces by default, it can be reached by any attacker who can connect to the designated port. Because no authentication is required, exploitation is straightforward and does not require privileged access. The resulting risk is a potential unauthorized data read or tampering, especially in environments where the service is exposed to untrusted networks.