CVE Feed

    Dashboard / CVE / CVE-2026-14868

    CVE-2026-14868

    The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.

    Published:Jul 7, 2026
    Last Modified:Jul 7, 2026
    EPS:Jul 7, 2026
    EPSS Score:0.00063
    CVSS Score:8.4

    Affected Products

    Vendor
    Arcinfo
    Product
    Pcvue

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-326 Inadequate Encryption Strength

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-112 Brute Force
    CAPEC-192 Protocol Analysis
    CAPEC-20 Encryption Brute Forcing

    Related CVEs

    CVE-2026-14867 (CVSS 6.8) — Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prio…
    CVE-2026-1698 (CVSS 5.3) — A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15…
    CVE-2026-1697 (CVSS 5.3) — The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue…
    CVE-2026-1696 (CVSS 2.3) — Some HTTP security headers are not properly set by the web server when sending responses to the client applica…
    CVE-2026-1695 (CVSS 5.3) — An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue fea…
    CVE-2026-1694 (CVSS 2.3) — HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment …
    CVE-2026-1693 (CVSS 5.3) — The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by…
    CVE-2026-1692 (CVSS 5.3) — A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the Web…
    CVE-2025-9999 (CVSS 7.6) — Some payload elements of the messages sent between two stations in a networking architecture are not properly …
    CVE-2025-9998 (CVSS 6) — The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High