CVE-2026-34184
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
AlanWeb SCADA does not enforce authorization for some directories, allowing an unauthorized attacker to read all files in these directories and even execute some of them. The attacker could run PHP scripts directly on the connected database. This issue was fixed in version 9.8.5.
Risk Assessment
The risk includes unauthorized access to sensitive files and potential takeover of the database, which could lead to data integrity and confidentiality breaches.
Recommendation
It is recommended to immediately upgrade AlanWeb SCADA to version 9.8.5 or later to mitigate the vulnerability.
Original NVD description (English source)
AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5