SecBoard
Zurück zur CVE-Übersicht

CVE-2026-100730

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • openPDC 2.9.482
  • openHistorian 2.8.585

Threat-Hunting-Queries

Detect deserialization of untrusted data leading to remote code execution. This may involve monitoring process creation, network connections, or unusual file modifications by the affected service account.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName in ("openPDC.exe", "openHistorian.exe")
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe") or ProcessCommandLine contains "-EncodedCommand"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
// Further refinement needed to filter legitimate commands vs. malicious RCE attempts

Splunk SPL

(sourcetype=WinEventLog:Security EventCode=4688 OR sourcetype=Process:Start) (ParentProcessName=openPDC.exe OR ParentProcessName=openHistorian.exe) (CommandLine=*powershell.exe* OR CommandLine=*cmd.exe* OR CommandLine=*-EncodedCommand*)
| table _time, host, ParentProcessName, CommandLine, User
// Further refinement needed to filter legitimate commands vs. malicious RCE attempts

Sigma

title: openPDC openHistorian Deserialization RCE Attempt
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential remote code execution attempts via deserialization vulnerability in openPDC or openHistorian.
author: SecBoard
date: 2026/10/08
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\openPDC.exe'
      - '\openHistorian.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand'
  condition: selection
fields:
  - CommandLine
  - ParentImage
  - Image
  - User
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.100730

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable : ("openPDC.exe", "openHistorian.exe")) and (process.executable : ("powershell.exe", "cmd.exe", "pwsh.exe")) and (process.args : "-EncodedCommand")
| select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, user.name
// Further refinement needed to filter legitimate commands vs. malicious RCE attempts

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen