Grid Protection Alliance openPDC and openHistorian
CISA warns openPDC and openHistorian have critical flaws, including unauthenticated remote code execution.
66
Vulnerability1 · 1 read
CVE-2026-85479
Missing authentication on openPDC STTP data publisher
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The STTP-based data publisher in Grid Protection Alliance openPDC accepts network connections without authentication when left in its default configuration. An unauthenticated remote attacker who can reach that interface can connect and exchange data with the publisher. CVSS 4.0 rates the issue medium (6.9), with low confidentiality impact and no integrity or availability impact (CWE-306, missing authentication for a critical function). It affects openPDC deployments that expose this publisher; the advisory data does not name a version range. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Treat the STTP data publisher as untrusted until authentication is enabled and the service is not reachable from untrusted networks. Restrict it with firewall or VPN controls, and follow Grid Protection Alliance / ICS-CERT guidance for openPDC rather than assuming a specific patch version. Review publisher logs and connected clients for unexpected data exchanges.
| Product | Affected |
|---|---|
| Grid Protection Alliance openPDC | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.
- Weakness
- CWE-306
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X