CVE-2026-88020

OpenPLC 3, an open-source programmable logic controller (PLC) runtime from Autonomy Logic, contains a cross-site scripting flaw (CWE-79) in its web interface: when the interface routes a program based on a query string parameter, the parameter is used without encoding or neutralization. An attacker can craft a malicious link that, when clicked by a user interacting with the OpenPLC web console, executes attacker-controlled script in the victim's browser in the context of the PLC's web application. Because that console manages control programs and physical I/O, a successful attack could allow session hijacking or unauthorized actions with the victim's privileges, such as viewing or manipulating control logic. The flaw is rated medium (CVSS 4.0: 5.3) and requires no privileges but does require user interaction, typical of reflected XSS. No public proof-of-concept exists and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Keep the OpenPLC 3 web console off the public internet and restrict access to a dedicated management network or VPN, and monitor the ICS-CERT advisory (this CVE was assigned by ics-cert@hq.dhs.gov) for a patched release to apply promptly. Train operators not to click untrusted links while an OpenPLC session is open, since the flaw is triggered via a crafted query-string URL requiring user interaction. As a compensating control, place a reverse proxy with input sanitization or a strict Content-Security-Policy header in front of the web interface to blunt reflected script execution.