Insertion of Sensitive Information into Logfile
Priority LOW 22CWE-532Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function of the PVI client application is disabled by default and must be explicitly enabled by the user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00126 2nd percentileScored 2026-11-07
Fix Fixed Process Visualization Interface (PVI) (B&R Industrial Automation GmbH): 6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| B&R Industrial Automation | Process Visualization Interface (PVI) | 4; 6 to before 6.5 | 6.5 | Patch available | CNA |
- Process Visualization Interface (PVI) VendorB&R Industrial Automation Affected 4; 6 to before 6.5 Fixed in 6.5 Patch available CNA
Remediation
- Fix · CNA Process Visualization Interface (PVI) (B&R Industrial Automation GmbH) Fixed in 6.5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0936
- 2026-10-03 Alias added: GHSA-24gc-rw47-8xrm
References
More B&R Industrial Automation vulnerabilities
- TI-2023-01522 Improper Authentication Mechanism in B&R VC4 Visualization CVSS 3.1CRITICAL 9.8
- TI-2022-21498 Buffer overflow when changing configuration on Tbase Server CVSS 3.1CRITICAL 9.8
- TI-2022-21496 Memory leak when receiving messages in APROL Tbase server CVSS 3.1CRITICAL 9.8
- TI-2022-21495 Lack of authentication when managing APROL database CVSS 3.1CRITICAL 9.4
- TI-2024-30523 Unauthorized local file reading in B&R APROL CVSS 4.0CRITICAL 9.2
- TI-2024-00297 FTP uses unsecure encryption mechanisms CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-0936 · CVE Program
- CVE-2026-0936 · NVD
- FIRST EPSS
- GHSA-24gc-rw47-8xrm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences