CVE-2026-6284CWE-521

Horner Automation Cscape and XL4, XL7 PLC Weak password requirements

Critical · published April 17, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00479 · 40.4th percentile
Weakness
CWE-521 · Weak Password Requirements
Published
2026-04-17T15:14Z
EPSS history
Timeline
  • 17 APR 15:14Z
    Horner Automation Cscape and XL4, XL7 PLC Weak password requirements
    cvelistv5