CVE-2026-4901

Modified Modified - Updated After Analysis

Credential Exposure via Log File in Hydrosystem Control System

Publication date: 2026-04-09

Last updated on: 2026-08-13

Assigner: CERT.PL

Description

AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-08-13

Generated

2026-08-15

AI Q&A

2026-04-09

EPSS Evaluated

2026-08-14

NVD

CVE-2026-4901

EUVD

EUVD-2026-20888

Affected Vendors & Products

Vendor	Product	Version / Range
hydrosystem.poznan	control_system	to 9.8.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Hydrosystem Control System where sensitive information, including user credentials, is saved into a log file. Because these credentials are logged, an attacker who gains access to the log file can obtain authorized access to the system. The issue is more severe when combined with another vulnerability, CVE-2026-34184, which could allow unauthorized users to access this sensitive information.

Impact Analysis

The vulnerability can lead to unauthorized access to the Hydrosystem Control System by exposing user credentials through log files. An attacker who obtains these credentials can gain further authorized access, potentially compromising system integrity, confidentiality, and availability.

Compliance Impact

This vulnerability involves the logging of sensitive information, including user credentials, which could be accessed by unauthorized users. Such exposure of sensitive data can lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of personal and sensitive information from unauthorized access.

By allowing attackers to obtain further authorized access through leaked credentials, the vulnerability increases the risk of data breaches, potentially violating confidentiality and security requirements mandated by these regulations.

Mitigation Strategies

The vulnerability was fixed in Hydrosystem Control System version 9.8.5. Immediate mitigation should include upgrading the system to this version or later to prevent sensitive user credentials from being logged.

Hi! I’m here to help you understand CVE-2026-4901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70