CVE-2026-1692
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear
Summary
A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website.
This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| arcinfo | PcVue | 16.0.0 <= 16.3.3 | affected |
| arcinfo | PcVue | 15.0.0 <= 15.2.13 | affected |
| arcinfo | PcVue | 12.0.0 | affected |
Weaknesses
- CWE-1385: CWE-1385 Missing Origin Validation in WebSockets
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.