Which versions of Brute Force are affected by EUVD-2026-23442?

Horner Automation XL4/XL7 PLCs and Cscape software are vulnerable to remote unauthenticated brute force attacks that could allow attackers to gain administrative access to industrial control systems.

How to fix or mitigate EUVD-2026-23442?

Within 24 hours: Identify all Horner XL4/XL7 PLCs and Cscape installations in your operational technology environment using network discovery tools; document firmware and software versions. Within 7 days: Implement network segmentation to restrict administrative access to affected systems to authorized personnel only; enforce strong password policies (minimum 12 characters, mixed complexity) on all accessible management interfaces; enable connection logging on network access points to affected devices. Within 30 days: Contact Horner Automation technical support for firmware/software updates addressing authentication and rate-limiting controls; test and deploy updates in controlled staging environment before production deployment; conduct audit of administrative credentials for unauthorized access attempts.

Brute Force EUVD-2026-23442

Q: What is the CVSS score of EUVD-2026-23442?

EUVD-2026-23442 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6284 CRITICAL

Weak Password Requirements (CWE-521)

2026-04-17 icscert

GHSA-r9f4-h79v-5p47

Authentication Bypass Brute Force

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Apr 17, 2026 - 16:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Apr 17, 2026 - 16:08 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 15:45 euvd

EUVD-2026-23442

Analysis Generated

Apr 17, 2026 - 15:45 vuln.today

CVE Published

Apr 17, 2026 - 15:14 nvd

CRITICAL 9.3

DescriptionCVE.org

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

AnalysisAI

Brute force password attacks against Horner Automation XL4/XL7 PLCs and Cscape software allow remote unauthenticated attackers to gain unauthorized administrative access via network connections. Weak password policies (limited complexity requirements) combined with absent rate limiting enable systematic credential enumeration. CVSS 9.1 (Critical) reflects network-accessible attack with no authentication required. CISA ICS-CERT advisory confirms vulnerability in operational technology environments where PLCs control industrial processes.

Technical ContextAI

Horner Automation Cscape is an engineering software platform for programming XL-series programmable logic controllers (PLCs) used in industrial automation. The vulnerability stems from CWE-521 (Weak Password Requirements), where authentication mechanisms lack two critical security controls: insufficient password complexity enforcement and missing brute-force mitigation (no account lockout, rate limiting, or CAPTCHA). Affected products per CPE data include Cscape software (cpe:2.3:a:horner_automation:cscape) and XL7/XL4 PLC firmware (cpe:2.3:a:horner_automation:xl7_plc and xl4_plc). The network-accessible nature (AV:N) indicates these authentication endpoints are exposed on TCP/IP interfaces, typical for PLC remote management protocols like Modbus TCP, EtherNet/IP, or proprietary OPC interfaces. In OT environments, PLCs often have predictable IP addresses on flat networks, making them discoverable through industrial protocol scanning tools like PLCScan or Nmap NSE scripts.

RemediationAI

Apply vendor-released updates from Horner Automation's Cscape software download page (https://hornerautomation.com/cscape-software-free/cscape-software/) - specific patched version numbers not confirmed in source data, consult vendor advisory for exact release addressing CVE-2026-6284. After patching, immediately change all PLC passwords to complex credentials (minimum 16 characters, mixed case, numbers, symbols) and disable default accounts. Compensating controls if patching is delayed: (1) Network segmentation - isolate PLCs on dedicated OT VLANs with firewall rules blocking port 80/443/502/44818 from corporate networks, allowing only engineering workstations via ACLs (trade-off: breaks remote monitoring until VPN configured). (2) Deploy industrial protocol firewall or IDS (Claroty, Nozomi, Dragos) to detect brute force patterns like rapid authentication failures or password spraying (trade-off: requires capital investment and OT security expertise). (3) Implement jump host architecture where engineers RDP into hardened bastion before accessing PLC programming interfaces (trade-off: adds operational friction, requires identity management integration). Note: Simply disabling network access is NOT viable for most OT environments requiring HMI connectivity - risk acceptance with monitoring may be necessary until patching window.