Description
AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user.
This issue was fixed in AlanWeb SCADA version 9.8.5
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Control System | AlanWeb SCADA | < 9.8.5 | 9.8.5 |
References
- https://cert.pl/posts/2026/04/CVE-2026-4901/ third-party-advisory
- https://control-system.pl/ product