CVE-2026-1693
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The vulnerability in PcVue is that the OAuth ROPC (Resource Owner Password Credentials) flow is still used by the webservices of WebVue, WebScheduler, TouchVue, and Snapvue features in versions 12.0.0 through 16.3.3, despite being deprecated. This could allow a remote attacker to steal user credentials.
Risk Assessment
The risk is that an attacker could capture usernames and passwords, leading to unauthorized access to the PcVue system and potentially taking control of industrial infrastructure.
Recommendation
It is recommended to immediately update PcVue to the latest version that disables or replaces the ROPC flow with a more secure authentication mechanism, and to implement additional network security measures such as restricting access to the webservices.
Other vulnerabilities in PcVue
See all- CVE-2020-26867Critical
A vulnerability in PcVue prior to version 12.0.17 is caused by the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
- CVE-2011-4042High
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
- CVE-2026-14868Medium
The vulnerability in PcVue before version 17.0.0 is due to the use of an insufficiently strong encryption algorithm for protecting user account configuration in the built-in directory. A local attacker can alter the existing configuration and gain privileged access to the application.
- CVE-2026-14867Medium
In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.
- CVE-2026-1698Medium
An HTTP Host header attack vulnerability in PcVue WebClient and WebScheduler web apps (versions 15.0.0 through 16.3.3) allows a remote attacker to inject harmful payloads that manipulate server-side behavior. The issue affects specific endpoints: /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout.
- CVE-2026-1697Medium
The Secure and SameSite attributes are missing in cookies used by the GraphicalData web services and WebClient web app of PcVue versions 12.0.0 through 16.3.3. This allows session hijacking and CSRF attacks.
- CVE-2026-1695Medium
An XSS vulnerability in PcVue OAuth services (versions 12.0.0–16.3.3) allows a remote attacker to inject malicious code into the OAuth server error page. The attack requires tricking an authenticated user into loading content from an external site after a failed login.
- CVE-2026-1694Medium
A vulnerability in PcVue (versions 12.0.0 through 16.3.3) causes HTTP headers to be added by the default IIS and ASP.NET configuration, which are not removed during the deployment of web services for WebVue, WebScheduler, TouchVue, and SnapVue features. This unnecessarily exposes sensitive server configuration information.
- CVE-2026-1692Medium
Missing origin validation in WebSockets in PcVue versions 12.0.0 through 16.3.3 (WebVue, WebScheduler, TouchVue, SnapVue) allows a remote attacker to lure an authenticated user to a malicious website. Only endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect are affected.
- CVE-2022-4312Medium
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. An unauthorized user with access to email and SMS account configuration files could discover SMTP account credentials and the SIM card PIN code.
Original NVD description (English source)
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.