Our takeCISA advisory for Grid Protection Alliance openPDC and openHistorian lists five CVEs (up to high severity) fixed in 2.9.477 and 2.9.482. Update affected instances promptly.Cyber Resilience desk
Sources (2)
- cisa_advisories · cisa_advisories
- cisa_ics · cisa_ics
What this means for you — Security leader:Update openPDC and openHistorian to 2.9.482 or later. The five CVEs include path traversal, deserialization, and authentication bypass that could let an attacker manipulate or exfiltrate grid telemetry.
What this means for you — Lean IT orgs:If you run openPDC or openHistorian for local monitoring or control systems, update immediately to version 2.9.482 or newer. Most smaller teams without these tools can ignore this advisory.
What this means for you — MSP:Audit every client running openPDC or openHistorian (especially Docker images) and upgrade to 2.9.482+. The CVEs allow remote code execution and data tampering in OT environments.
What this means for you — Researcher:CISA advisory ICSA-26-281-02 details five CVEs in Grid Protection Alliance openPDC <2.9.482 and openHistorian; path traversal, unsafe deserialization, and weak auth are the main vectors.