CVE-2026-34184

Katalog CVE

CVSS 9.1 · Critical EPSS 0,46%

Kerentanan Missing Authorization pada hydrosystem.poznan control system. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

13 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert.pl/posts/2026/04/CVE-2026-4901/ advisory vendor
• https://control-system.pl/