CVEvulnerability

CVE-2026-1693

5.3 MEDIUM Published 2026-02-26 Modified 2026-07-09 Official page ↗
Status
Analyzed
Published
2026-02-26
Last modified
2026-07-09
Assigner
87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932
CVSS 4.0 (87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932)
5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1390, CWE-477

Description

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.

Affected configurations

• arcinfo pcvue (>= 12.0.0 <= 15.2.13) • arcinfo pcvue (>= 16.0.0 < 16.3.4)

Related

Weakness · CWE (2)

  • CWE-1390 Weak Authentication weakness
  • CWE-477 Use of Obsolete Function weakness

References