CVE-2026-6284: Horner Automation Cscape, XL4 and XL7 PLC - Weak Password Requirements
CVE-2026-6284 affects Horner Automation Cscape and the XL4 and XL7 PLCs, where limited password complexity and the absence of password input limits make brute force password discovery possible for an attacker with network access to the device. The CNA (ICS-CERT) rated it CVSS 3.1 9.1 and CVSS 4.0 9.3. No confirmed exploitation appears in the sources consulted, and the record shows it is not listed in CISA KEV.
Overview
The CVE record describes weak password requirements in Horner Automation Cscape and in the XL4 and XL7 PLCs, classified as CWE-521 (Weak Password Requirements). According to the record, an attacker with network access to the PLC can brute force passwords because complexity is limited and there are no input limiters. The CNA is ICS-CERT, and the referenced advisory is ICSA-26-106-02.
Impact
The record states that successful password discovery could give unauthorized access to systems and services. The CVSS 3.1 vector indicates a network attack vector, low attack complexity, no privileges required, no user interaction, high confidentiality and integrity impact, and no availability impact. The SSVC data in the record lists technical impact as total and automatable as yes.
Affected products and versions
- Horner Automation Cscape, version 10.0
- Horner Automation XL4 PLC, version 16.32.0
- Horner Automation XL7 PLC, version 15.60
The record lists no fixed versions. That absence does not confirm that no fix exists, so the vendor page and the CISA advisory should be checked for current status.
Exploitation status
The record marks the vulnerability as not listed in CISA KEV, and the SSVC exploitation field is none. No confirmed exploitation appears in the sources consulted. The EPSS probability of 0.00479 (percentile 0.39602) is a statistical estimate of exploitation likelihood and is not evidence that exploitation has occurred.
Remediation and mitigation
- Check the vendor and the CISA advisory for updates, since the record contains no fixed version.
- Restrict network access to PLCs and engineering software to trusted segments, and separate control networks from business networks.
- Replace default or weak credentials with strong, unique passwords wherever the product allows it.
- Apply network-layer controls that limit which hosts can reach PLC services.
- Maintain verified offline backups of PLC programs and follow change management for any configuration change.
Detection guidance
- Monitor for repeated failed authentication attempts against PLCs and engineering workstations.
- Review access logs for logins from unexpected hosts or at unusual times.
- Track configuration and project changes on PLCs and Cscape projects.
Limitations of the available information
The record does not provide a detailed technical description, confirmed patch status, or the specific password policy of the affected products. The record shows an EPSS date of 2026-10-13, which should be verified against the source. The referenced vendor page and CSAF file are listed in the record, but their contents were not included in the data provided for this analysis.
Frequently asked questions
What is the core weakness in CVE-2026-6284?
The record classifies it as CWE-521, weak password requirements. Limited password complexity and no password input limits allow brute force password discovery by an attacker with network access to the PLC.
Which products and versions are listed as affected?
The record lists Horner Automation Cscape version 10.0, Horner Automation XL4 PLC version 16.32.0 and Horner Automation XL7 PLC version 15.60. No fixed versions are listed in the record.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV and that the SSVC exploitation field is none. No confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.