CVE-2026-1697
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Secure and SameSite attributes are missing in cookies used by the GraphicalData web services and WebClient web app of PcVue versions 12.0.0 through 16.3.3. This allows session hijacking and CSRF attacks.
Risk Assessment
Missing these attributes exposes the organization to session theft and unauthorized actions performed in the context of user sessions, potentially leading to data leakage or account takeover.
Recommendation
Upgrade PcVue to a version later than 16.3.3 where the Secure and SameSite attributes are added. If upgrade is not possible, configure the web server to enforce these attributes.
Other vulnerabilities in PcVue
See all- CVE-2020-26867Critical
A vulnerability in PcVue prior to version 12.0.17 is caused by the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
- CVE-2011-4042High
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
- CVE-2026-14868Medium
The vulnerability in PcVue before version 17.0.0 is due to the use of an insufficiently strong encryption algorithm for protecting user account configuration in the built-in directory. A local attacker can alter the existing configuration and gain privileged access to the application.
- CVE-2026-14867Medium
In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.
- CVE-2026-1698Medium
An HTTP Host header attack vulnerability in PcVue WebClient and WebScheduler web apps (versions 15.0.0 through 16.3.3) allows a remote attacker to inject harmful payloads that manipulate server-side behavior. The issue affects specific endpoints: /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback, and /Authentication/Logout.
- CVE-2026-1695Medium
An XSS vulnerability in PcVue OAuth services (versions 12.0.0–16.3.3) allows a remote attacker to inject malicious code into the OAuth server error page. The attack requires tricking an authenticated user into loading content from an external site after a failed login.
- CVE-2026-1694Medium
A vulnerability in PcVue (versions 12.0.0 through 16.3.3) causes HTTP headers to be added by the default IIS and ASP.NET configuration, which are not removed during the deployment of web services for WebVue, WebScheduler, TouchVue, and SnapVue features. This unnecessarily exposes sensitive server configuration information.
- CVE-2026-1693High
The vulnerability in PcVue is that the OAuth ROPC (Resource Owner Password Credentials) flow is still used by the webservices of WebVue, WebScheduler, TouchVue, and Snapvue features in versions 12.0.0 through 16.3.3, despite being deprecated. This could allow a remote attacker to steal user credentials.
- CVE-2026-1692Medium
Missing origin validation in WebSockets in PcVue versions 12.0.0 through 16.3.3 (WebVue, WebScheduler, TouchVue, SnapVue) allows a remote attacker to lure an authenticated user to a malicious website. Only endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect are affected.
- CVE-2022-4312Medium
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. An unauthorized user with access to email and SMS account configuration files could discover SMTP account credentials and the SIM card PIN code.
Original NVD description (English source)
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.