This vulnerability (CVE-2026-6284) affects Horner Automation's Cscape software version 10.0. It stems from weak password policies and the lack of mechanisms to limit password input attempts, allowing an attacker with network access to the programmable logic controller (PLC) to perform brute force attacks to discover valid passwords. Successful exploitation results in unauthorized access to the affected systems and services. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with high impact on confidentiality and integrity.

An attacker can gain unauthorized access to PLC systems and services by brute forcing passwords due to weak password complexity and no input attempt restrictions. This compromises the confidentiality and integrity of the affected systems, potentially allowing control or disruption of industrial processes managed by the PLC.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should restrict network access to the PLC to trusted entities only and consider implementing network-level controls to detect and block brute force attempts. Enhancing password policies where possible and monitoring for unusual authentication activity are recommended interim measures.