PT-2026-31600 · Unknown · Hydrosystem Control System

Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-34184

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hydrosystem Control System versions prior to 9.8.5

Description The Hydrosystem Control System does not properly enforce authorization for certain directories. This allows an unauthorized attacker to read all files within these directories and potentially execute them. An attacker could run PHP scripts directly on the connected database.

Recommendations Update to version 9.8.5 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-34184

Affected Products

Hydrosystem Control System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34184 · Security Note
• https://cert.pl/posts/2026/04/CVE-2026-4901 · Vendor Advisory
• https://twitter.com/CVEnew/status/2042186484862816767 · Twitter Post
• https://twitter.com/CVEarity/status/2042568827943505923 · Twitter Post
• https://hydrosystem.poznan.pl · Note