CVE-2020-26868
HighCVSS 7.5Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
A vulnerability in PcVue prior to version 12.0.17 allows an unauthorized user to modify information used to validate messages from legitimate web clients, leading to a denial-of-service (DoS) attack. This issue also affects third-party systems based on the Web Services Toolkit.
Risk Assessment
The attack can disrupt SCADA system operations, preventing operators from monitoring and controlling industrial processes, which in critical infrastructure may cause severe operational disruptions.
Recommendation
Immediately update PcVue to version 12.0.17 or later. For third-party systems based on the Web Services Toolkit, apply the appropriate patches provided by the vendor.
Other vulnerabilities in PcVue
See all- CVE-2020-26867Critical
A vulnerability in PcVue prior to version 12.0.17 is caused by the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
- CVE-2011-4042High
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
- CVE-2026-14868Medium
The vulnerability in PcVue before version 17.0.0 is due to the use of an insufficiently strong encryption algorithm for protecting user account configuration in the built-in directory. A local attacker can alter the existing configuration and gain privileged access to the application.
- CVE-2026-14867Medium
In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.
- CVE-2026-1698Medium
An HTTP Host header attack vulnerability in PcVue WebClient and WebScheduler web apps (versions 15.0.0 through 16.3.3) allows a remote attacker to inject harmful payloads that manipulate server-side behavior. The issue affects specific endpoints: /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout.
- CVE-2026-1697Medium
The Secure and SameSite attributes are missing in cookies used by the GraphicalData web services and WebClient web app of PcVue versions 12.0.0 through 16.3.3. This allows session hijacking and CSRF attacks.
- CVE-2026-1695Medium
An XSS vulnerability in PcVue OAuth services (versions 12.0.0–16.3.3) allows a remote attacker to inject malicious code into the OAuth server error page. The attack requires tricking an authenticated user into loading content from an external site after a failed login.
- CVE-2026-1694Medium
A vulnerability in PcVue (versions 12.0.0 through 16.3.3) causes HTTP headers to be added by the default IIS and ASP.NET configuration, which are not removed during the deployment of web services for WebVue, WebScheduler, TouchVue, and SnapVue features. This unnecessarily exposes sensitive server configuration information.
- CVE-2026-1693High
The vulnerability in PcVue is that the OAuth ROPC (Resource Owner Password Credentials) flow is still used by the webservices of WebVue, WebScheduler, TouchVue, and Snapvue features in versions 12.0.0 through 16.3.3, despite being deprecated. This could allow a remote attacker to steal user credentials.
- CVE-2026-1692Medium
Missing origin validation in WebSockets in PcVue versions 12.0.0 through 16.3.3 (WebVue, WebScheduler, TouchVue, SnapVue) allows a remote attacker to lure an authenticated user to a malicious website. Only endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect are affected.
Original NVD description (English source)
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit.