« Volver al listado

CVE-2026-1693

Estado: AnalizadaMedia (5.3)—

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arcinfo — Pcvue

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-1693",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "ssvcData": {
          "role": "CNA",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3"
        }
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-1693",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-26T14:22:29.948819Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 5.3,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "CLEAR",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "affectedData": [
        {
          "vendor": "arcinfo",
          "modules": [
            "WebVue",
            "WebScheduler",
            "TouchVue",
            "SnapVue",
            "Web services"
          ],
          "product": "PcVue",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.0",
              "versionType": "cpe",
              "lessThanOrEqual": "16.3.3"
            },
            {
              "status": "affected",
              "version": "15.0.0",
              "versionType": "cpe",
              "lessThanOrEqual": "15.2.13"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "cpe"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-26T08:16:18.490",
  "references": [
    {
      "url": "https://www.pcvue.com/security/#SB2026-2",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "description": [
        {
          "lang": "en",
          "value": "CWE-477"
        },
        {
          "lang": "en",
          "value": "CWE-1390"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials."
    },
    {
      "lang": "es",
      "value": "El flujo de tipo de concesión OAuth Credenciales de Contraseña del Propietario del Recurso (ROPC) sigue siendo utilizado por los servicios web utilizados por las características WebVue, WebScheduler, TouchVue y Snapvue de PcVue en la versión 12.0.0 hasta la 16.3.3 incluida a pesar de estar desaprobado. Podría permitir a un atacante remoto robar credenciales de usuario."
    }
  ],
  "lastModified": "2026-07-09T18:32:08.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C70C58B7-92FF-4D6D-AACB-0F2FDF56E750",
              "versionEndIncluding": "15.2.13",
              "versionStartIncluding": "12.0.0"
            },
            {
              "criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50259E97-1C6D-4E3B-A3A0-824864907518",
              "versionEndExcluding": "16.3.4",
              "versionStartIncluding": "16.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
}