CVE-2026-34184

CRITICAL

9.1

Descricao

Hydrosystem Control System does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database.This issue was fixed in Hydrosystem Control System version 9.8.5

Detalhes CVE

Pontuacao CVSS v3.19.1

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado4/9/2026

Ultima modificacao4/20/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

hydrosystem.poznan:control_system

Fraquezas (CWE)

CWE-862

Referencias

https://cert.pl/posts/2026/04/CVE-2026-4901/(cvd@cert.pl)

https://www.hydrosystem.poznan.pl/(cvd@cert.pl)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.