VDE-2026-085 — Weidmueller: SQL Injection Vulnerability in PROCON-WEB SCADA

Summary

A remote unauthenticated attacker can exploit a SQL injection vulnerability in PROCON-WEB SCADA to execute arbitrary commands.

Details

Impact
Successful exploitation allows an unauthenticated attacker to read, modify or delete data and to execute arbitrary SQL commands, potentially leading to further compromise of the underlying system.

Remediation
It is strongly advised to update PROCON-WEB SCADA to version 6.11.3.

| Product | Affected Version | Fixed Version |
|---------|-----------------|----------------|
| PROCON-WEB SCADA | <=6.11.2 | 6.11.3 |

Vulnerabilities 1

Critical 9.8

CVE-2026-16462

SQL injection via unauthenticated GetGridData endpoint

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.

Weidmueller Interface PROCON-WEB SCADA

Jul 28, 2026

Revision history

2026-07-28 #1.0.0
Initial version

References

Weidmueller Security Advisory Board
https://support.weidmueller.com/support-center/popular-resources/security-advisory-board
CERT@VDE Security Advisories for Weidmueller
https://certvde.com/de/advisories/vendor/weidmueller/
VDE-2026-085: Weidmueller: SQL Injection Vulnerability in PROCON-WEB SCADA - HTML
https://certvde.com/de/advisories/VDE-2026-085