CVE-2026-101022

openPDC’s Modbus connection feature accepts a caller-specified destination address and port and does not restrict which internal hosts may be targeted (CWE-918, server-side request forgery). An authenticated user can attempt connections to arbitrary internal destinations and learn which ones respond; repeated attempts can map reachable hosts on the internal network. The impact is limited to low confidentiality of network reachability, with no integrity or availability impact and no unauthenticated access. Grid Protection Alliance openPDC deployments, typically in utility and research synchrophasor environments, are affected; no version range was stated. It is not in CISA KEV and no public proof-of-concept is known.

What to do: Limit Modbus connection configuration to trusted administrators, and place openPDC on a segmented network with egress controls so it cannot open connections to arbitrary internal hosts. Review logs for repeated connection attempts to unexpected addresses or ports. Apply any Grid Protection Alliance or ICS-CERT fix when one is published; the data does not name a safe version.