CVE-2026-101022
Medium5.3A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
- CVSS
- 5.3v4.0
- EPSS (exploit probability)
- 0.2%8th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-20 | 0.2% | 7.7% |
| 2026-10-19 | 0.2% | 7.7% |
| 2026-10-18 | 0.2% | 7.6% |
| 2026-10-16 | 0.2% | 7.6% |
| 2026-10-15 | 0.2% | 7.6% |
| 2026-10-14 | 0.2% | 7.6% |
| 2026-10-13 | 0.2% | 7.6% |
| 2026-10-12 | 0.2% | 7.5% |
| 2026-10-11 | 0.2% | 7.5% |
| 2026-10-10 | 0.2% | 7.5% |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X