Which versions of Unknown ICS device are affected by CVE-2026-49033?

An unspecified industrial control system contains a critical local code execution vulnerability (CVE-2026-49033, CVSS 8.4) that can fully compromise system confidentiality, integrity, and…

How to fix or mitigate CVE-2026-49033?

Within 24 hours: Contact your ICS vendor and product teams to determine if this vulnerability affects any deployed systems; enable enhanced logging on any confirmed affected systems. Within 7 days: Restrict local user access to affected systems through administrative controls; implement network segmentation to isolate affected ICS infrastructure from corporate networks; require multi-factor authentication for local access where operationally feasible. Within 30 days: Monitor vendor security advisories for patch availability; evaluate air-gapping or temporary operational restrictions if the affected product is mission-critical and no patch has been released.

Unknown ICS device CVE-2026-49033

Q: What is the CVSS score of CVE-2026-49033?

CVE-2026-49033 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42122 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-07 ics-cert@hq.dhs.gov

GHSA-h3p7-vr3q-c8g3

RCE Buffer Overflow Stack Overflow

8.4

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector and required user interaction to process malicious input, no privileges needed, and a stack overflow yielding full code execution give C/I/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 22:34 vuln.today

DescriptionCVE.org

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.

AnalysisAI

Local arbitrary code execution affects an unspecified industrial control system (ICS) product reported through CISA ICS-CERT (advisory ICSA-26-188-06). A stack-based buffer overflow (CWE-121) lets an attacker who can supply crafted input trigger memory corruption and run arbitrary code once a local user interacts with the malicious data, fully compromising confidentiality, integrity, and availability. No public exploit identified at time of analysis and the affected vendor/product is not disclosed in the available data.

Technical ContextAI

The root cause is CWE-121, a stack-based buffer overflow: the application copies attacker-controlled data into a fixed-size stack buffer without adequate bounds checking, overwriting adjacent stack memory such as saved return addresses, which enables control-flow hijacking and arbitrary code execution. The CISA ICS advisory reference (icsa-26-188-06) indicates this is industrial control system software - typically an engineering workstation application, HMI, device configuration tool, or embedded controller firmware - where memory-unsafe C/C++ parsing of project files, protocol messages, or device data is common. No CPE strings were provided, so the exact product, component, and affected code path cannot be pinned from the input.

RemediationAI

No vendor-released patch version is identified in the provided data; consult CISA ICS advisory ICSA-26-188-06 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-188-06) for the vendor's fixed version and official guidance, and apply the vendor update as the primary fix once identified. Because the vector is local and requires user interaction, effective compensating controls include restricting which files and data the application processes to trusted sources only, avoiding opening project files or device data from untrusted origins, and isolating engineering workstations on segmented OT networks with application allow-listing - trade-off: these workflow restrictions can slow legitimate engineering operations and do not remove the underlying flaw. Enforce least-privilege on the host so that code execution does not immediately yield elevated OT control, accepting that this limits but does not prevent compromise.