CVE-2026-4901
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
AlanWeb SCADA saves sensitive information, including user credentials, into a log file. Combined with another vulnerability (CVE-2026-34184), an unauthorized user could access this data and gain further authorized access to the system.
Risk Assessment
Exposure of credentials could lead to unauthorized access to the SCADA system, potentially compromising the integrity and confidentiality of industrial data.
Recommendation
Immediately upgrade AlanWeb SCADA to version 9.8.5 or later, which includes the fix. Also review and remove sensitive data from existing log files.
Other vulnerabilities in AlanWeb SCADA
See all- CVE-2026-34184Critical
AlanWeb SCADA does not enforce authorization for some directories, allowing an unauthorized attacker to read all files in these directories and even execute some of them. The attacker could run PHP scripts directly on the connected database. This issue was fixed in version 9.8.5.
- CVE-2026-34185High
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. An authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in version 9.8.5.
Original NVD description (English source)
AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5