« Volver al listado

CVE-2026-14868

Estado: AnalizadaAlta (8.4)—

The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L, PR:L sin UI permite escalada local. CWE-326 (cifrado débil) y la alteración de configuración de cuentas de usuario en PcVue sustenta modificación de cuentas (T1098.002) e implícitamente control de autenticación (T1556.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementMulti-factor AuthenticationUser TrainingThreat Intelligence ProgramPrivileged Process IntegrityExecution Prevention

Tecnologías afectadas (1)

Arcinfo — Pcvue

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-14868",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "ssvcData": {
          "role": "CNA",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-14868",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-07T12:07:11.716678Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 8.4,
          "Automatable": "YES",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "affectedData": [
        {
          "vendor": "arcinfo",
          "product": "PcVue",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "17.0.0",
              "versionType": "cpe"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-07T10:16:40.273",
  "references": [
    {
      "url": "https://www.pcvue.com/security/#SB2026-5",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application."
    }
  ],
  "lastModified": "2026-07-09T18:32:08.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62062D62-40E8-496A-A847-6D864DDA46C9",
              "versionEndExcluding": "17.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
}