CVE-2026-6284

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6284", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-04-14T15:07:32.676Z", "datePublished": "2026-04-17T15:14:06.346Z", "dateUpdated": "2026-04-20T14:58:32.621Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-04-17T15:14:06.346Z"}, "title": "Horner Automation Cscape and XL4, XL7 PLC Weak password requirements", "datePublic": "2026-04-16T17:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-521", "description": "CWE-521", "type": "CWE"}]}], "affected": [{"vendor": "Horner Automation", "product": "Cscape", "versions": [{"status": "affected", "version": "10.0"}], "defaultStatus": "unaffected"}, {"vendor": "Horner Automation", "product": "XL7 PLC", "versions": [{"status": "affected", "version": "15.60"}], "defaultStatus": "unaffected"}, {"vendor": "Horner Automation", "product": "XL4 PLC", "versions": [{"status": "affected", "version": "16.32.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible."}]}], "references": [{"url": "https://hornerautomation.com/cscape-software-free/cscape-software/"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-02.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Horner Automation recommends users update to Cscape v10.2 SP2 or later. Horner Automation has also released the latest firmware for both XL4 and XL7 PLCs. Horner recommends users update to the latest version of the firmware.\u00a0\n https://hornerautomation.com/cscape-software-free/cscape-software/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Horner Automation recommends users update to Cscape v10.2 SP2 or later. Horner Automation has also released the latest firmware for both XL4 and XL7 PLCs. Horner recommends users update to the latest version of the firmware.&nbsp;<br><a href=\"https://hornerautomation.com/cscape-software-free/cscape-software/\" title=\"(opens in a new window)\">https://hornerautomation.com/cscape-software-free/cscape-software/</a>"}]}], "credits": [{"lang": "en", "value": "An anonymous researcher reported this vulnerability to CISA", "type": "finder"}], "source": {"advisory": "ICSA-26-106-02", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-521", "lang": "en", "description": "CWE-521 Weak Password Requirements"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T16:06:19.870633Z", "id": "CVE-2026-6284", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:58:32.621Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-17T16:06:19.870633Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-521", "description": "CWE-521 Weak Password Requirements"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T16:06:29.555Z"}}], "cna": {"title": "Horner Automation Cscape and XL4, XL7 PLC Weak password requirements", "source": {"advisory": "ICSA-26-106-02", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "An anonymous researcher reported this vulnerability to CISA"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Horner Automation", "product": "Cscape", "versions": [{"status": "affected", "version": "10.0"}], "defaultStatus": "unaffected"}, {"vendor": "Horner Automation", "product": "XL7 PLC", "versions": [{"status": "affected", "version": "15.60"}], "defaultStatus": "unaffected"}, {"vendor": "Horner Automation", "product": "XL4 PLC", "versions": [{"status": "affected", "version": "16.32.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Horner Automation recommends users update to Cscape v10.2 SP2 or later. Horner Automation has also released the latest firmware for both XL4 and XL7 PLCs. Horner recommends users update to the latest version of the firmware.\u00a0\n https://hornerautomation.com/cscape-software-free/cscape-software/", "supportingMedia": [{"type": "text/html", "value": "Horner Automation recommends users update to Cscape v10.2 SP2 or later. Horner Automation has also released the latest firmware for both XL4 and XL7 PLCs. Horner recommends users update to the latest version of the firmware.&nbsp;<br><a href=\"https://hornerautomation.com/cscape-software-free/cscape-software/\" title=\"(opens in a new window)\">https://hornerautomation.com/cscape-software-free/cscape-software/</a>", "base64": false}]}], "datePublic": "2026-04-16T17:00:00.000Z", "references": [{"url": "https://hornerautomation.com/cscape-software-free/cscape-software/"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-02.json"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.", "supportingMedia": [{"type": "text/html", "value": "An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-521", "description": "CWE-521"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-04-17T15:14:06.346Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6284", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:58:32.621Z", "dateReserved": "2026-04-14T15:07:32.676Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-04-17T15:14:06.346Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cscape", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "10.0"}]}, {"defaultStatus": "unaffected", "product": "XL7 PLC", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "15.60"}]}, {"defaultStatus": "unaffected", "product": "XL4 PLC", "vendor": "Horner Automation", "versions": [{"status": "affected", "version": "16.32.0"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible."}, {"lang": "es", "value": "Un atacante con acceso de red al PLC es capaz de descubrir contrase\u00f1as por fuerza bruta para obtener acceso no autorizado a sistemas y servicios. La complejidad limitada de las contrase\u00f1as y la ausencia de limitadores de entrada de contrase\u00f1as hace posible la enumeraci\u00f3n de contrase\u00f1as por fuerza bruta."}], "id": "CVE-2026-6284", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6284", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T16:06:19.870633Z", "version": "2.0.3"}}]}, "published": "2026-04-17T16:17:07.620", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-02.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://hornerautomation.com/cscape-software-free/cscape-software/"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-521"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-521"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10.0"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Cscape", "source": "cna", "vendor": "Horner Automation"}, "product": "cscape", "vendor": "hornerautomation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "16.32.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "XL4 PLC", "source": "cna", "vendor": "Horner Automation"}, "product": "xl4_plc", "vendor": "hornerautomation"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15.60"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "XL7 PLC", "source": "cna", "vendor": "Horner Automation"}, "product": "xl7_plc", "vendor": "hornerautomation"}], "analysis": {"en": {"generated_at": "2026-04-18T09:15:56.337698+00:00", "value": {"mitigation_remediation": ["Apply the latest Cscape release (v10.2\u202fSP2 or newer) to all affected systems.", "Upgrade the firmware on all XL4 and XL7 PLCs to the most recent versions provided by Horner Automation.", "Configure network controls to limit PLC access to trusted devices and enforce strong password policies, including account lockout mechanisms, to mitigate brute\u2011force attempts."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized system access via password brute force"}, "threat_synthesis": {"affected_systems": "Affected products include Horner Automation Cscape, XL4 PLC, and XL7 PLC. Vendor documentation recommends upgrading to Cscape v10.2\u202fSP2 or later and installing the latest firmware on all XL4 and XL7 PLCs. No specific version numbers are listed in the advisory, so all current releases without these updates are potentially vulnerable.", "description_and_impact": "An attacker with network access to a Horner Automation PLC can brute\u2011force the login interface because passwords are weak and no input limiters are applied. This allows the attacker to obtain administrative credentials and then gain unauthorized access to the PLC\u2019s control and monitoring functions, potentially compromising critical industrial processes. The vulnerability is a classic example of Weak Credentials (CWE\u2011521).", "risk_and_exploitability": "The CVSS score of 9.3 indicates a critical severity, yet the EPSS score is not available and the vulnerability is not listed in CISA\u2019s KEV catalog. Because the attack requires only network connectivity to the PLC and no privileged local access, it is fairly easy for an attacker operating on the same network segment to mount an enumeration attack. With no account lockout or input throttling, brute\u2011force attempts can succeed quickly, raising the likelihood of exploitation."}}}}, "created": "2026-04-17T20:35:16.252960+00:00", "updated": "2026-04-18T09:30:25.676880+00:00", "vendors": ["hornerautomation", "hornerautomation$PRODUCT$cscape", "hornerautomation$PRODUCT$xl4_plc", "hornerautomation$PRODUCT$xl7_plc"]}