{
  "id": 19486226,
  "title": "From HTTP to SSH: Finding a Host-Level Attack Path in OpenPLC v3",
  "url": "https://urgent.news/2026/11/11/from-http-to-ssh-finding-a-host-level-attack-path-in-openplc-v3",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-11T07:42:27.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/from-http-to-ssh-finding-a-host-level-attack-path-in-openplc-v3?source=rss"
  },
  "original_language": "en",
  "account": "The investigative journey began with a software PLC, designed to run complex industrial control logic on a conventional computer rather than a physical controller. This change in architecture alters the security landscape, as the control logic interacts with the host operating system during storage, compilation, and loading.\n\nThe researcher focused on modifying the PLC's active control logic through its deployment environment, seeking to replace the existing program and execute the altered logic without going through the typical management workflow.\n\nInitially, the researcher explored the Beremiz platform, but it proved challenging due to its complex architecture and communication mechanisms. After nearly nine hours of investigation, the researcher decided to shift targets.\n\nThe next target was OpenPLC v3, which offered a more accessible environment for the investigation. The researcher set up an isolated Ubuntu 24.04 virtual machine using Multipass, installing OpenPLC v3, its dependencies, and the runtime. The management dashboard was accessible via HTTP.\n\nThe researcher then proceeded to map the target's exposed services, identifying three key services: SSH, Modbus TCP, and an HTTP-based management dashboard. The SSH service became particularly important for remote administration.\n\nThe researcher focused on the management application, examining its endpoints and authentication process. Once logged in, the researcher used a Flask session cookie to explore the management workflow programmatically. The goal was to reproduce the program management and compilation sequence through HTTP requests, aiming to deliver and execute a modified control program.",
  "summary": "An OpenPLC v3 security experiment demonstrating how SSH access can enable unauthorized control logic replacement, compilation, and execution.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}