SQL Injection Vulnerability in Hydrosystem Control System by Hydrosystem
CVE-2026-34185

8.7HIGH

Key Information:

Vendor

Hydrosystem

Status
Control System
Vendor
CVE Published:
9 April 2026

What is CVE-2026-34185?

The Hydrosystem Control System suffers from a security flaw that allows authenticated attackers to exploit SQL Injection vulnerabilities in numerous scripts and input fields. This weakness arises from the absence of adequate security controls, which permits the execution of arbitrary SQL commands. Consequently, this can lead to unauthorized access and manipulation of the database, potentially resulting in significant data breaches. Users are strongly advised to upgrade to version 9.8.5 or later to mitigate this vulnerability.

Affected Version(s)

Control System 0 < 9.8.5

References

https://cert.pl/posts/2026/04/CVE-2026-4901/
third-party-advisory
https://www.hydrosystem.poznan.pl/
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jarosław "Jahrek" Kamiński - Securitum
.