Executive brief
PcVue is a monitoring and control platform used in industrial environments like power plants and water systems. A security issue was found where certain web components do not use standard security flags for browser cookies. This could allow an attacker to potentially intercept or manipulate user sessions, leading to unauthorized access to the monitoring interface.
Technical details
PcVue versions 12.0.0 through 16.3.3 are vulnerable to cookie security attribute omissions (CWE-614 and CWE-1275). Specifically, the GraphicalData web services and WebClient web application do not implement the 'Secure' attribute, which ensures cookies are only sent over encrypted connections, nor the 'SameSite' attribute, which helps prevent Cross-Site Request Forgery (CSRF). An unauthenticated remote attacker could potentially capture session cookies over unencrypted channels or perform cross-site attacks to gain unauthorized access to the web interface. The vendor has addressed this in version 16.3.4 and other subsequent updates.
Affected products
- ARC Informatique (arcinfo) PcVue 12.0.0 through 16.3.3
Timeline
- 2026-02-26: disclosed
- 2026-02-26: advisory: Vendor advisory SB2026-2 published