← Back

CVE-2026-1693

nvd nist
Published: Feb 26, 2026Modified: Jul 9, 2026

JSON object

Loading...
5.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:ClearShow less
Source: 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932 (Secondary)

Description

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.

Affected (2)

Products: Arcinfo: Pcvue
Arcinfo
1 product
Pcvue
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Arcinfo
Pcvue
From 12.0.0 to 15.2.13
Pcvue
From 16.0.0 to 16.3.4

Related CWEs

CWE-1390
Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
CWE-477
Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

References (1)

Source: 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932
Vendor Advisory

Timeline

No history available yet.