This vulnerability (CVE-2026-6284) in Horner Automation Cscape 10.0 involves weak password policies and absence of password input limiters, allowing an attacker with network access to perform brute force attacks to discover passwords. The lack of complexity requirements and input throttling facilitates password enumeration, potentially leading to unauthorized system and service access on the affected PLCs. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker on the network to gain unauthorized access to PLC systems and services by brute forcing passwords. This can compromise the confidentiality and integrity of the affected systems. There is no indication of availability impact or requirement for user interaction. No known exploits in the wild have been reported.

No official patch or remediation is currently available from Horner Automation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, organizations should consider network-level protections such as restricting network access to the PLC, monitoring for brute force attempts, and enforcing strong password policies where possible.