{“lastseen”:””,”description”:”An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.”,”published”:”2026-04-17T15:14:06.346Z”,”modified”:”2026-04-17T15:14:06.346Z”,”type”:”cve”,”title”:”Horner Automation Cscape and XL4, XL7 PLC Weak password requirements”,”source”:”icscert”,”references”:”https:\/\/hornerautomation.com\/cscape-software-free\/cscape-software\/\\nhttps:\/\/www.cisa.gov\/news-events\/ics-advisories\/icsa-26-106-02\\nhttps:\/\/github.com\/cisagov\/CSAF\/blob\/develop\/csaf_files\/OT\/white\/2026\/icsa-26-106-02.json”,”id”:”CVE-2026-6284″,”bulletinFamily”:””,”cwe”:[“CWE-521″],”cvelist”:null,”sourceData”:”Horner Automation Cscape 10.0\\nHorner Automation XL7 PLC 15.60\\nHorner Automation XL4 PLC 16.32.0″,”sourceHref”:””,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Cscape”,”version”:”10.0″,”vendor”:”Horner Automation”,”ai_description”:”Weak password requirements allow brute force password enumeration and unauthorized access to systems and services.”,”ai_severity”:”Critical”,”ai_vendor”:”Horner Automation”,”ai_product”:”Cscape, XL4 PLC, XL7 PLC”,”ai_version”:”10.0, 15.60, 16.32.0″,”ai_score”:9.3}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[9,6,8,55,12,13,7,11,5],"class_list":["post-47639","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n