Authenticated code execution via unvalidated hardware-layer code

Code injection in Open PLC Webserver 3 allows remote authenticated users to execute arbitrary code through the /hardware page. The Hardware Layer Code Box accepts attacker-supplied C source as custom_layer_code, and the compile workflow builds and loads it without restricting executable operations. Valid web credentials and the ability to stop, compile, and restart the PLC are required; successful exploitation runs attacker code on the host.