# CVE-2021-31630

Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application.

- Page: https://www.vulneraibility.com/cve/CVE-2021-31630
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 27.07% (percentile 98.1)
- Unvetted proof-of-concept code on GitHub: 12 GitHub proofs of concept (first 2021-08-02)
- Published: 2021-08-03

## Affected

- openplcproject:openplc_v3_firmware

## References

- [other] https://www.youtube.com/watch?v=l08DHB08Gow
- [other] https://packetstormsecurity.com/files/162563/OpenPLC-WebServer-3-Remote-Code-Execution.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.