« Volver al listado

CVE-2026-1698

Estado: AnalizadaMedia (5.3)—

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.

This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arcinfo — Pcvue

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-1698",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "ssvcData": {
          "role": "CNA",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-1698",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-26T14:30:06.903784Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 5.3,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "CLEAR",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "affectedData": [
        {
          "vendor": "arcinfo",
          "modules": [
            "WebVue",
            "WebScheduler"
          ],
          "product": "PcVue",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "versionType": "cpe",
              "lessThanOrEqual": "16.3.3"
            },
            {
              "status": "affected",
              "version": "15.0.0",
              "versionType": "cpe",
              "lessThanOrEqual": "15.2.13"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-26T08:16:19.897",
  "references": [
    {
      "url": "https://www.pcvue.com/security/#SB2026-2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "description": [
        {
          "lang": "en",
          "value": "CWE-644"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.\n\nThis vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout\nof the WebClient and WebScheduler web apps."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ataque de encabezado Host HTTP afecta a las aplicaciones web WebClient y WebScheduler de PcVue en las versiones 15.0.0 hasta la 16.3.3 incluidas, permitiendo a un atacante remoto inyectar cargas útiles maliciosas que manipulan el comportamiento del lado del servidor.\n\nEsta vulnerabilidad solo afecta a los puntos finales /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback y /Authentication/Logout de las aplicaciones web WebClient y WebScheduler."
    }
  ],
  "lastModified": "2026-07-09T18:32:08.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3F90916-E0DF-461E-AA4E-47F1C6868FBA",
              "versionEndIncluding": "15.2.13",
              "versionStartIncluding": "15.0.0"
            },
            {
              "criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50259E97-1C6D-4E3B-A3A0-824864907518",
              "versionEndExcluding": "16.3.4",
              "versionStartIncluding": "16.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
}