CVE-2026-14868

The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.pcvue.com/security/#SB2026-5	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*

History

25 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) El algoritmo de cifrado utilizado para proteger la configuración de las cuentas de usuario, almacenadas en el directorio de usuarios integrado de los proyectos de PcVue, todas las versiones anteriores a la 17.0.0, no es lo suficientemente fuerte para el nivel de protección requerido. Un atacante local podría alterar la configuración existente y, en última instancia, obtener acceso privilegiado a la aplicación PcVue.

Information

Published : 2026-07-07 10:16

Updated : 2026-10-25 20:10

NVD link : CVE-2026-14868

Mitre link : CVE-2026-14868

CVE.ORG link : CVE-2026-14868

JSON object : View

Products Affected

arcinfo

pcvue

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2026-14868", "cveTags": [], "metrics": {"ssvcV203": [{"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "ssvcData": {"role": "CNA", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14868", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T12:07:11.716678Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.4, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "affectedData": [{"vendor": "arcinfo", "product": "PcVue", "versions": [{"status": "affected", "version": "0", "lessThan": "17.0.0", "versionType": "cpe"}], "defaultStatus": "affected"}]}], "published": "2026-07-07T10:16:40.273", "references": [{"url": "https://www.pcvue.com/security/#SB2026-5", "tags": ["Vendor Advisory"], "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all\u00a0versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application."}, {"lang": "es", "value": "El algoritmo de cifrado utilizado para proteger la configuraci\u00f3n de las cuentas de usuario, almacenadas en el directorio de usuarios integrado de los proyectos de PcVue, todas las versiones anteriores a la 17.0.0, no es lo suficientemente fuerte para el nivel de protecci\u00f3n requerido. Un atacante local podr\u00eda alterar la configuraci\u00f3n existente y, en \u00faltima instancia, obtener acceso privilegiado a la aplicaci\u00f3n PcVue."}], "lastModified": "2026-10-25T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62062D62-40E8-496A-A847-6D864DDA46C9", "versionEndExcluding": "17.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}