CVE-2026-14867
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.
Risk Assessment
The risk involves potential credential theft by a local attacker, which could lead to unauthorized access to the PcVue system and potentially compromise SCADA projects.
Recommendation
Immediately upgrade PcVue to version 17.0.0 or later. Until the update, restrict local access to stations running PcVue projects and consider using Active Directory accounts instead of built-in ones.
Original NVD description (English source)
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability.