CVE-2026-6284
Brute Force Password Vulnerability in PLC Enables Unauthorized Access
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| horner_automation | cscape | 10.2_sp2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-521 | The product does not require that users should have strong passwords. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an attacker who has network access to a Programmable Logic Controller (PLC) to perform brute force attacks to discover passwords.
Because the system enforces limited password complexity and does not have any password input limiters, it is possible for attackers to repeatedly try different passwords until they find the correct one.
This leads to unauthorized access to systems and services controlled by the PLC.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to critical systems and services managed by the PLC.
Since the attacker can gain access without needing prior privileges or user interaction, this can compromise the confidentiality and integrity of the system.
Such unauthorized access could allow attackers to manipulate system operations or steal sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker with network access to brute force discover passwords due to limited password complexity and lack of input limiters, leading to unauthorized access to systems and services.
Such unauthorized access can result in exposure or compromise of sensitive data, which may violate requirements under common standards and regulations like GDPR and HIPAA that mandate strong access controls and protection of personal or health information.
Therefore, this vulnerability negatively impacts compliance by undermining the security controls necessary to protect sensitive data and prevent unauthorized access.