Control System CVE-2026-4901

This vulnerability stems from insecure logging practices (CWE-532: Insertion of Sensitive Information into Log File) in the Hydrosystem Control System application. The root cause is the failure to implement log sanitization or credential masking during the logging process. User credentials-including usernames and passwords or authentication tokens-are written in plaintext to log files that may be accessible to system administrators or other privileged users. The CVSS vector indicates network-accessible exposure (AV:N) with low attack complexity (AC:L) but requires high privileges (PR:H), limiting the immediate threat to already-compromised or malicious administrators. The chaining reference to CVE-2026-34184 suggests a secondary vulnerability may provide unauthorized access to these log files, significantly amplifying the risk in multi-vulnerability exploitation chains.