CVE-2026-6284: PLC Brute Force Password Bypass (CVSS 9.1)

Overview

CVE-2026-6284 is a critical authentication vulnerability affecting a programmable logic controller (PLC) with a CVSS score of 9.1 (Critical). The flaw stems from insufficient password complexity requirements combined with the complete absence of login attempt rate-limiting or account lockout mechanisms. Any attacker with network access to the device can enumerate valid credentials through brute force, leading to unauthorized access to industrial systems and services.

Technical Details

The vulnerability exists because the affected PLC:

• Enforces no minimum password complexity (short, simple passwords are permitted by the device firmware)
• Implements no input limiters — there are no account lockout policies, CAPTCHA challenges, or rate limits on login attempts
• Exposes the authentication interface directly to network-accessible endpoints

An attacker with network visibility to the PLC can systematically iterate password candidates without triggering any defensive mechanism, making discovery of valid credentials trivial. Once authenticated, full access to PLC configuration, ladder logic, I/O control, and connected SCADA systems is possible.

Affected Products

Impact

Successful exploitation allows an attacker to:

• Modify PLC logic — alter industrial process behavior without authorization
• Disable safety interlocks — potentially causing physical harm or equipment damage
• Exfiltrate operational data — gather information about industrial processes, throughput, and configurations
• Use the PLC as a pivot point — move laterally into connected OT/SCADA networks

In critical infrastructure environments — including manufacturing plants, utilities, water treatment, and energy facilities — this level of unauthorized access can have severe physical and operational consequences.

Remediation

Until an official vendor patch is available, operators should implement the following mitigations:

1. Network isolation — place PLCs behind firewalls and restrict network access to trusted engineering workstations only
2. VPN enforcement — require VPN tunnels for any remote access to OT networks
3. Strong password policy — configure the maximum allowable password length and complexity at the system level
4. Monitor authentication logs — alert on repeated failed login attempts; implement external rate-limiting via network-layer controls (firewall rules, ACLs)
5. Disable unused network interfaces — minimize the attack surface by disabling any network services not strictly required

References

• NVD — CVE-2026-6284
• ICS-CERT Advisories
• CISA ICS Security Best Practices