CVE-2026-1693
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear
Summary
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| arcinfo | PcVue | 16.0.0 <= 16.3.3 | affected |
| arcinfo | PcVue | 15.0.0 <= 15.2.13 | affected |
| arcinfo | PcVue | 12.0.0 | affected |
Weaknesses
- CWE-1390: CWE-1390 Weak Authentication
- CWE-477: CWE-477 Use of Obsolete Function
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.