CVE-2020-26869

A vulnerability in PcVue prior to version 12.0.17 is caused by the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.

An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.

The vulnerability in PcVue before version 17.0.0 is due to the use of an insufficiently strong encryption algorithm for protecting user account configuration in the built-in directory. A local attacker can alter the existing configuration and gain privileged access to the application.

In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.

An HTTP Host header attack vulnerability in PcVue WebClient and WebScheduler web apps (versions 15.0.0 through 16.3.3) allows a remote attacker to inject harmful payloads that manipulate server-side behavior. The issue affects specific endpoints: /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout.

The Secure and SameSite attributes are missing in cookies used by the GraphicalData web services and WebClient web app of PcVue versions 12.0.0 through 16.3.3. This allows session hijacking and CSRF attacks.

An XSS vulnerability in PcVue OAuth services (versions 12.0.0–16.3.3) allows a remote attacker to inject malicious code into the OAuth server error page. The attack requires tricking an authenticated user into loading content from an external site after a failed login.

A vulnerability in PcVue (versions 12.0.0 through 16.3.3) causes HTTP headers to be added by the default IIS and ASP.NET configuration, which are not removed during the deployment of web services for WebVue, WebScheduler, TouchVue, and SnapVue features. This unnecessarily exposes sensitive server configuration information.

The vulnerability in PcVue is that the OAuth ROPC (Resource Owner Password Credentials) flow is still used by the webservices of WebVue, WebScheduler, TouchVue, and Snapvue features in versions 12.0.0 through 16.3.3, despite being deprecated. This could allow a remote attacker to steal user credentials.

Missing origin validation in WebSockets in PcVue versions 12.0.0 through 16.3.3 (WebVue, WebScheduler, TouchVue, SnapVue) allows a remote attacker to lure an authenticated user to a malicious website. Only endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect are affected.