EUVD-2026-23442
GHSA-r9f4-h79v-5p47
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionNVD
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.
AnalysisAI
Brute force password attacks against Horner Automation XL4/XL7 PLCs and Cscape software allow remote unauthenticated attackers to gain unauthorized administrative access via network connections. Weak password policies (limited complexity requirements) combined with absent rate limiting enable systematic credential enumeration. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Horner XL4/XL7 PLCs and Cscape installations in your operational technology environment using network discovery tools; document firmware and software versions. Within 7 days: Implement network segmentation to restrict administrative access to affected systems to authorized personnel only; enforce strong password policies (minimum 12 characters, mixed complexity) on all accessible management interfaces; enable connection logging on network access points to affected devices. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today