{"id":"CVE-2026-105281","published":"2026-10-09T14:17:11.450","lastModified":"2026-10-11T17:17:01.723","description":"The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The openPDC's internal data publisher allows unauthenticated connections in its default configuration, enabling attackers to retrieve complete device and measurement topology information without any credentials. This represents a significant information disclosure vulnerability that could expose critical infrastructure mapping details to unauthorized parties.","exploitability":"Exploitation is straightforward with no prerequisites as the service runs unauthenticated by default, requiring only network access to the affected interface.","blast_radius":"The impact could be substantial across industrial control systems and smart grid environments where openPDC is deployed, potentially exposing sensitive operational topology data to attackers who can then plan targeted attacks on critical infrastructure components.","remediation":"Disable the internal data publisher service or restrict network access to the affected interface until a patched version is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["information-disclosure","ics","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:02:08.186Z"}}