CVE-2026-14867
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.
Risk Assessment
The risk involves potential credential theft by a local attacker, which could lead to unauthorized access to the PcVue system and potentially compromise SCADA projects.
Recommendation
Immediately upgrade PcVue to version 17.0.0 or later. Until the update, restrict local access to stations running PcVue projects and consider using Active Directory accounts instead of built-in ones.
Other vulnerabilities in PcVue
See all- CVE-2020-26867Critical
A vulnerability in PcVue prior to version 12.0.17 is caused by the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
- CVE-2011-4042High
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
- CVE-2026-14868Medium
The vulnerability in PcVue before version 17.0.0 is due to the use of an insufficiently strong encryption algorithm for protecting user account configuration in the built-in directory. A local attacker can alter the existing configuration and gain privileged access to the application.
- CVE-2026-1698Medium
An HTTP Host header attack vulnerability in PcVue WebClient and WebScheduler web apps (versions 15.0.0 through 16.3.3) allows a remote attacker to inject harmful payloads that manipulate server-side behavior. The issue affects specific endpoints: /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout.
- CVE-2026-1697Medium
The Secure and SameSite attributes are missing in cookies used by the GraphicalData web services and WebClient web app of PcVue versions 12.0.0 through 16.3.3. This allows session hijacking and CSRF attacks.
- CVE-2026-1695Medium
An XSS vulnerability in PcVue OAuth services (versions 12.0.0–16.3.3) allows a remote attacker to inject malicious code into the OAuth server error page. The attack requires tricking an authenticated user into loading content from an external site after a failed login.
- CVE-2026-1694Medium
A vulnerability in PcVue (versions 12.0.0 through 16.3.3) causes HTTP headers to be added by the default IIS and ASP.NET configuration, which are not removed during the deployment of web services for WebVue, WebScheduler, TouchVue, and SnapVue features. This unnecessarily exposes sensitive server configuration information.
- CVE-2026-1693High
The vulnerability in PcVue is that the OAuth ROPC (Resource Owner Password Credentials) flow is still used by the webservices of WebVue, WebScheduler, TouchVue, and Snapvue features in versions 12.0.0 through 16.3.3, despite being deprecated. This could allow a remote attacker to steal user credentials.
- CVE-2026-1692Medium
Missing origin validation in WebSockets in PcVue versions 12.0.0 through 16.3.3 (WebVue, WebScheduler, TouchVue, SnapVue) allows a remote attacker to lure an authenticated user to a malicious website. Only endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect are affected.
- CVE-2022-4312Medium
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. An unauthorized user with access to email and SMS account configuration files could discover SMTP account credentials and the SIM card PIN code.
Original NVD description (English source)
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability.