Brute Force Password Vulnerability in Horner Automation PLC Systems
CVE-2026-6284
9.3CRITICAL
What is CVE-2026-6284?
A vulnerability exists in Horner Automation's Cscape Software that allows an attacker with network access to the PLC to exploit weak password settings. This vulnerability stems from limited password complexity requirements and the absence of input limiters, which facilitates brute force attempts to discover passwords. Such weaknesses can lead to unauthorized access to critical systems and services, posing a significant risk to operational security.
Affected Version(s)
Cscape 10.0
XL4 PLC 16.32.0
XL7 PLC 15.60
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
An anonymous researcher reported this vulnerability to CISA