CVE-2026-1694

HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.pcvue.com/security/#SB2026-2	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arcinformatique:pcvue::::::::
	cpe:2.3:a:arcinformatique:pcvue::::::::

History

No history.

Information

Published : 2026-02-26 08:16

Updated : 2026-03-12 14:25

NVD link : CVE-2026-1694

Mitre link : CVE-2026-1694

CVE.ORG link : CVE-2026-1694

JSON object : View

Products Affected

arcinformatique

pcvue

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

{"id": "CVE-2026-1694", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 2.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-26T08:16:18.763", "references": [{"url": "https://www.pcvue.com/security/#SB2026-2", "tags": ["Vendor Advisory"], "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "description": [{"lang": "en", "value": "CWE-201"}]}], "descriptions": [{"lang": "en", "value": "HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration."}, {"lang": "es", "value": "Los encabezados HTTP son a\u00f1adidos por la configuraci\u00f3n predeterminada de IIS y ASP.net, y no son eliminados en la fase de despliegue de los servicios web utilizados por las funcionalidades WebVue, WebScheduler, TouchVue y SnapVue de PcVue desde la versi\u00f3n 12.0.0 hasta la 16.3.3 incluida. Esto expone innecesariamente informaci\u00f3n sensible sobre la configuraci\u00f3n del servidor."}], "lastModified": "2026-03-12T14:25:17.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "991311B5-07A8-4CA5-9A07-17D0110128AF", "versionEndIncluding": "15.2.13", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36C7C670-9A8E-49CD-A04C-8426A4C0C911", "versionEndExcluding": "16.3.4", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}