CVE-2026-4901
Credential Exposure via Log File in Hydrosystem Control System
Publication date: 2026-04-09
Last updated on: 2026-04-20
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hydrosystem.poznan | control_system | to 9.8.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the Hydrosystem Control System by exposing user credentials through log files. An attacker who obtains these credentials can gain further authorized access, potentially compromising system integrity, confidentiality, and availability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability was fixed in Hydrosystem Control System version 9.8.5. Immediate mitigation should include upgrading the system to this version or later to prevent sensitive user credentials from being logged.
Can you explain this vulnerability to me?
This vulnerability occurs in the Hydrosystem Control System where sensitive information, including user credentials, is saved into a log file. Because these credentials are logged, an attacker who gains access to the log file can obtain authorized access to the system. The issue is more severe when combined with another vulnerability, CVE-2026-34184, which could allow unauthorized users to access this sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the logging of sensitive information, including user credentials, which could be accessed by unauthorized users. Such exposure of sensitive data can lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access.
By allowing attackers to obtain further authorized access through leaked credentials, the vulnerability increases the risk of data breaches, potentially violating confidentiality and security requirements mandated by these regulations.