CVE-2026-34184
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
AlanWeb SCADA does not enforce authorization for some directories, allowing an unauthorized attacker to read all files in these directories and even execute some of them. The attacker could run PHP scripts directly on the connected database. This issue was fixed in version 9.8.5.
Risk Assessment
The risk includes unauthorized access to sensitive files and potential takeover of the database, which could lead to data integrity and confidentiality breaches.
Recommendation
It is recommended to immediately upgrade AlanWeb SCADA to version 9.8.5 or later to mitigate the vulnerability.
Other vulnerabilities in AlanWeb SCADA
See all- CVE-2026-4901Medium
AlanWeb SCADA saves sensitive information, including user credentials, into a log file. Combined with another vulnerability (CVE-2026-34184), an unauthorized user could access this data and gain further authorized access to the system.
- CVE-2026-34185High
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. An authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in version 9.8.5.
Original NVD description (English source)
AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5
Vulnerability data from NVD (NIST) · CISA KEV · EPSS