CVE-2026-6284

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

Score

CVSS 4.0 9.3 Critical

Status

Awaiting Analysis - ics-cert@hq.dhs.gov

Published

2026-04-17

Last modified

2026-10-25

Weaknesses

CWE-521

Affected products

• Cscape (Horner Automation)
• Xl4 Plc (Horner Automation)
• Xl7 Plc (Horner Automation)

References

• https://hornerautomation.com/cscape-software-free/cscape-software/
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-02
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-02.json