CVE-2026-6284

critical · 9.3

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

9.3

CVSS

0.4%

EPSS (exploit prob.)

38th

EPSS percentile

2026-04-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-521

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-02.json
https://hornerautomation.com/cscape-software-free/cscape-software/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-02

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-6284