---
id: CVE-2025-13970
title: |-
  OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack 
  due to the absence of proper CSRF validation
summary: |-
  OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack 
  due to the absence of proper CSRF validation. This issue allows an 
  unauthenticated attacker to trick a logged-in administrator into 
  visiting a maliciously crafted …
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H'
cwe:
  - CWE-352
published: '2025-12-13'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13970'
references:
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-345-10.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://github.com/thiagoralves/OpenPLC_v3'
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
epss: 0.00291
epssPercentile: 0.20052
ingestedAt: '2026-10-14T13:30:58.422Z'
---

## Overview

OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack 
due to the absence of proper CSRF validation. This issue allows an 
unauthenticated attacker to trick a logged-in administrator into 
visiting a maliciously crafted link, potentially enabling unauthorized 
modification of PLC settings or the upload of malicious programs which 
could lead to significant disruption or damage to connected systems.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.