CVE-2021-31630

HIGH

OpenPLC Webserver v3 - Remote Code Execution via Hardware Layer Code Box

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 12 public exploits for CVE-2021-31630. PoCs published by thewhiteh4t, Hunt3r0x, machevalia.

AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2021-31630, an authenticated remote code execution vulnerability in OpenPLC WebServer v3. The exploit uploads a malicious C payload to the target, compiles it, and executes a reverse shell.

Description

Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application.

Exploits (12)

nomisec WORKING POC 21 stars
by thewhiteh4t · poc
https://github.com/thewhiteh4t/cve-2021-31630

This repository contains a functional Python exploit for CVE-2021-31630, an authenticated remote code execution vulnerability in OpenPLC WebServer v3. The exploit uploads a malicious C payload to the target, compiles it, and executes a reverse shell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC WebServer v3
Auth required
Prerequisites: Valid credentials for OpenPLC WebServer · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 9 stars
by Hunt3r0x · poc
https://github.com/Hunt3r0x/CVE-2021-31630-HTB

This repository contains a functional exploit for CVE-2021-31630, targeting OpenPLC on the WifineticTwo Hack The Box machine. The exploit authenticates with provided credentials, uploads a malicious payload via a multipart form, and establishes a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC (version not specified)
Auth required
Prerequisites: Valid OpenPLC credentials · Network access to target · Listener setup for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by machevalia · poc
https://github.com/machevalia/OpenPLC-CVE-2021-31630-RCE

This repository contains a functional Python exploit for CVE-2021-31630, an authenticated RCE vulnerability in OpenPLC v3. The exploit uploads a malicious custom hardware layer containing a reverse shell payload, compiles it, and triggers execution to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC v3
Auth required
Prerequisites: Valid credentials for OpenPLC web interface · Network access to the target · Listener setup for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB 2 stars
by hev0x · poc
https://github.com/hev0x/CVE-2021-31630-OpenPLC_RCE

The repository contains only a minimal README with a title and brief description, lacking any exploit code or technical details. It claims to be an exploit for CVE-2021-31630 but provides no functional implementation or analysis.

Classification
Stub 90%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: OpenPLC v3 Webserver
Auth required
Prerequisites: Authenticated access to OpenPLC v3 Webserver
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by adibna · poc
https://github.com/adibna/cve-2021-31630

This repository contains a functional Python script that exploits CVE-2021-31630, a command injection vulnerability in OpenPLC Web Server v3. The exploit automates the process of uploading a malicious payload to the 'Hardware Layer Code Box' component, compiling it, and establishing a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC Web Server v3
Auth required
Prerequisites: Network access to the target OpenPLC Web Server · Valid credentials for the OpenPLC Web Server
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by tranquac · poc
https://github.com/tranquac/OpenPLC_v3

The repository contains a functional exploit for CVE-2021-31630, a command injection vulnerability in OpenPLC v3's web server. The exploit leverages unsanitized input in the hardware layer code box to execute arbitrary commands, demonstrated via a reverse shell payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC v3
No auth needed
Prerequisites: Network access to OpenPLC web interface · Vulnerable version of OpenPLC v3
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by UserB1ank · poc
https://github.com/UserB1ank/CVE-2021-31630

This repository contains a functional exploit for CVE-2021-31630, targeting OpenPLC_v3 WebServer. The exploit leverages a code injection vulnerability in the hardware layer customization feature to achieve remote command execution (RCE) by embedding malicious code in the `initCustomLayer()` function.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC_v3 WebServer
Auth required
Prerequisites: Valid credentials for OpenPLC WebServer · Access to the upload and hardware customization features
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by FlojBoj · poc
https://github.com/FlojBoj/CVE-2021-31630

This repository contains a functional exploit for CVE-2021-31630, an authenticated RCE vulnerability in OpenPLC WebServer v3. The exploit authenticates, uploads a malicious C file with a reverse shell payload, compiles it, and executes it to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC WebServer v3
Auth required
Prerequisites: Valid credentials for OpenPLC WebServer · Network access to the target · Listener setup for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by manuelsantosiglesias · poc
https://github.com/manuelsantosiglesias/CVE-2021-31630

This repository contains a functional exploit for CVE-2021-31630, an authenticated remote code execution vulnerability in OpenPLC WebServer v3. The exploit leverages command injection to upload and execute a malicious payload, resulting in a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC WebServer v3
Auth required
Prerequisites: Valid credentials for OpenPLC WebServer · Network access to the target · Python 3 with requests library
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by junnythemarksman · poc
https://github.com/junnythemarksman/CVE-2021-31630

This repository contains a functional exploit for CVE-2021-31630, targeting OpenPLC WebServer v3. The exploit authenticates, uploads a malicious program, and achieves remote code execution via a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC WebServer v3
Auth required
Prerequisites: Valid credentials for OpenPLC WebServer · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by mind2hex · poc
https://github.com/mind2hex/CVE-2021-31630-OpenPLC-3-Authenticated-RCE

This repository contains a functional exploit for CVE-2021-31630, an authenticated remote code execution vulnerability in OpenPLC WebServer v3. The exploit leverages command injection in the 'Hardware Layer Code Box' component to execute arbitrary code via a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC WebServer v3
Auth required
Prerequisites: Valid credentials for OpenPLC WebServer · Network access to the target · Listener set up for reverse shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by behindsecurity · poc
https://github.com/behindsecurity/htb-wifinetictwo-exploit

This repository contains a functional Python exploit for CVE-2021-31630, targeting OpenPLC on the WifineticTwo HackTheBox machine. The exploit automates login, uploads a malicious payload to achieve remote code execution, and triggers a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPLC WebServer 3
Auth required
Prerequisites: Python 3 · requests library · valid credentials for OpenPLC · network access to target
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.youtube.com/watch?v=l08DHB08Gow

Scores

CVSS v3 8.8
EPSS 0.2707
EPSS Percentile 97.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
openplcproject/openplc_v3_firmware
Published Aug 03, 2021
Tracked Since Feb 18, 2026