Grid Protection Alliance openPDC and openHistorian

What happened

On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution (running programs on a machine from somewhere else) under the privileges of the affected service account.

Systems using Windows Authentication are additionally protected, as they require the attacker to already be authenticated to reach this function. Grid Protection Alliance openPDC (Docker image) < 2.9.482 Product Status: known_affected Remediations No fix planned Grid Protection Alliance does not recommend production use of published Docker images in any case.

The fix for this vulnerability has not been published to the Docker image. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.