CVE-2026-28205

CVE-2026-28205 affects OpenPLC_V3 and involves an initialization of a resource with an insecure default vulnerability that enables attackers to bypass authentication mechanisms through the API. This flaw exposes the system to unauthorized access by leveraging improper default security configurations during resource initialization. The vulnerability has a FAUCET Risk Score of 52.0/100, indicating moderate concern from a risk perspective. While specific CVSS vector details are not currently available, the vulnerability permits authentication bypass, which represents a significant threat to system confidentiality and access control. The attack appears to require API access but could potentially be exploited with low complexity once an attacker identifies the default configuration weakness. This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no indication of active exploitation in the wild. The vulnerability remains on the inactive Hot List, suggesting limited community attention or publicly available exploit code at this time. However, organizations running OpenPLC_V3 should prioritize patching given the authentication bypass risk, as default credential and configuration vulnerabilities typically attract adversary interest once disclosure occurs.