CVEvulnerability

CVE-2026-1692

5.3 MEDIUM Published 2026-02-26 Modified 2026-07-09 Official page ↗
Status
Analyzed
Published
2026-02-26
Last modified
2026-07-09
Assigner
87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932
CVSS 4.0 (87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932)
5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-1385

Description

A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website. This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.

Affected configurations

• arcinfo pcvue (>= 12.0.0 <= 15.2.13) • arcinfo pcvue (>= 16.0.0 < 16.3.4)

Related

Weakness · CWE (1)

  • CWE-1385 Missing Origin Validation in WebSockets weakness

References