AlanWeb SCADA vulnerabilities

AlanWeb SCADA does not enforce authorization for some directories, allowing an unauthorized attacker to read all files in these directories and even execute some of them. The attacker could run PHP scripts directly on the connected database. This issue was fixed in version 9.8.5.

AlanWeb SCADA saves sensitive information, including user credentials, into a log file. Combined with another vulnerability (CVE-2026-34184), an unauthorized user could access this data and gain further authorized access to the system.

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. An authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in version 9.8.5.