CVE-2026-0393
Hard-Coded Credentials in Visualization Software
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codesys | visualization | to 4.10.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-0393 is a vulnerability in the CODESYS Visualization login dialog where authentication data is not sufficiently isolated during concurrent login operations.
This flaw allows an authenticated visualization user to obtain credentials entered by another user, potentially with higher privileges.
The issue only affects login operations within an active visualization session and can be triggered via both local and remote access.
How can this vulnerability impact me? :
This vulnerability can allow a low privileged user to access credentials of other users, including those with higher privileges.
As a result, an attacker could escalate their privileges within the system, potentially gaining unauthorized access to sensitive functions or data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in CODESYS Visualization login dialog, users can avoid using the "User Management -> Login" input action and instead use "User Management -> Logout" followed by a new login.
Alternatively, if property handling in visualization settings is not required, it can be disabled to reduce risk.
The recommended remediation is to update CODESYS Visualization to version 4.10.0.0, which involves recompiling affected projects and downloading the updated application to the HMI or PLC.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated visualization user to obtain credentials entered by another user, potentially with higher privileges, due to insufficient isolation of authentication data during concurrent login operations.
This exposure of credentials could lead to unauthorized access to sensitive information, which may impact compliance with data protection standards and regulations such as GDPR and HIPAA that require strict controls on access to personal and sensitive data.
Mitigating the vulnerability by updating to the fixed version or applying recommended workarounds is important to maintain compliance with these standards.