EUVD-2026-39509
GHSA-xm98-9qfh-q6g4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exploitation of this vulnerability could allow an attacker to disclose information and execute arbitrary code.
AnalysisAI
Out-of-bounds read in Horner Automation Cscape prior to 10.2 SP3 lets an attacker who supplies a malicious CSP project file disclose memory contents and, per the advisory, achieve arbitrary code execution within the engineering workstation. Cscape is the configuration/programming environment for Horner OCS controllers, so the target is the engineer's PC rather than the PLC itself. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Brute force password attacks against Horner Automation XL4/XL7 PLCs and Cscape software allow remote unauthenticated att
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). Rated hig
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). Rated hig
The affected product does not properly validate user-supplied data. Rated high severity (CVSS 7.8), this vulnerability i
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT). Rated high s
Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). Rated hig
The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP). Rated hi
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). Rated hig
Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. Rated high severit
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today