Pcvue
CVE-2026-1693
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify ROPC-enabled OAuth endpoint
-
ExploitSend crafted token request with user credentials
-
ExecutionIntercept plaintext credentials from response
-
ImpactUse stolen credentials for unauthorized access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Deprecated function removal
|
| Exploitation Conditions | PcVue versions 12.0.0 through 16.3.3 with WebVue, WebScheduler, TouchVue, or Snapvue features enabled using deprecated ROPC OAuth grant type flow on webservices without credential transmission protection. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
PcVue versions 12.0.0 through 16.3.3 use the deprecated OAuth Resource Owner Password Credentials flow in their web services, enabling remote attackers to steal user credentials without authentication or user interaction. The vulnerability affects WebVue, WebScheduler, TouchVue, and Snapvue components and carries a high severity rating with no patch currently available.
Earlier versions of this analysis (1)
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. [CVSS 7.5 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Pcvue. The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
Know when Pcvue gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear
Primary rating from Vendor (87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932) · only source for this CVE.
CVSS VectorVendor: 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932
Lifecycle Timeline
3DescriptionCVE.org
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
Executive ViewAI
PcVue versions 12.0.0 through 16.3.3 contain a high-severity vulnerability in their web services authentication mechanism that could allow attackers to compromise user credentials and gain unauthorized access to critical operations like scheduling and monitoring. Organizations using these versions face elevated risk of account takeover and operational disruption until this is remediated.
Implement Web Application Firewall (WAF) rules to restrict OAuth ROPC grant requests; enforce network segmentation limiting web service access to trusted internal networks only; disable ROPC authentication method in PcVue configuration if alternative OAuth 2.0 flows (authorization code, client credentials) are supported; enforce multi-factor authentication on user accounts accessing PcVue; implement rate limiting on authentication endpoints; enable comprehensive logging and real-time alerting on failed authentication attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may al
Privilege escalation in ARC Informatique PcVue SCADA/HMI software (all versions prior to 17.0.0) arises because the encr
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an una
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to ac
Insecure credential storage in PcVue exposes built-in user account passwords to any local attacker with low-privileged f
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. Rated medi
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session d
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. Rated medium se
Cross-site scripting (XSS) in PcVue's OAuth error page (versions 12.0.0-16.3.3) allows remote attackers to inject malici
PcVue versions 15.0.0 through 16.3.3 are vulnerable to HTTP Host header injection in the WebClient and WebScheduler auth
PcVue versions 12.0.0 through 16.3.3 lack origin validation on WebSocket connections in the GraphicalData service, enabl
PcVue versions 12.0.0 through 16.3.3 lack Secure and SameSite cookie attributes in the GraphicalData web services and We
GitHub PoC
Exploit-DB