Horner Automation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-12897 Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files.High 8.4 · Jun 25, 2026
• CVE-2026-6284 An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services.Critical 9.3 · Apr 17, 2026
• CVE-2025-4098 Horner Automation Cscape version 10.0 (10.0.415.2) SP1 is vulnerable to an out-of-bounds read vulnerability that could allow an attacker to disclose informationHigh 8.4 · May 8, 2025
• CVE-2024-9508 Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code.High 8.5 · Dec 12, 2024
• CVE-2024-12212 The vulnerability occurs in the parsing of CSP files.High 8.5 · Dec 12, 2024
• CVE-2023-7206 In Horner Automation Cscape versions 9.90 SP10 and prior, local attackers are able to exploit this vulnerability if a user opens a malicious CSP file, which woHigh 7.8 · Jan 15, 2024
• CVE-2023-32203 Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI).High 7.8 · Jun 6, 2023
• CVE-2023-31278 Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI).High 7.8 · Jun 6, 2023
• CVE-2023-31244 The affected product does not properly validate user-supplied data.High 7.8 · Jun 6, 2023
• CVE-2023-29503 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).High 7.8 · Jun 6, 2023
• CVE-2023-28653 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).High 7.8 · Jun 6, 2023
• CVE-2023-27916 The affected application lacks proper validation of user-supplied data when parsing font files (e.g., FNT).High 7.8 · Jun 6, 2023
• CVE-2023-32539 Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI).High 7.8 · Jun 6, 2023
• CVE-2023-32289 The affected application lacks proper validation of user-supplied data when parsing project files (e.g.., CSP).High 7.8 · Jun 6, 2023
• CVE-2023-32281 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).High 7.8 · Jun 6, 2023
• CVE-2023-32545 The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP).High 7.8 · Jun 6, 2023
• CVE-2023-0623 Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e.High 7.8 · Mar 9, 2023
• CVE-2023-0622 Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e.High 7.8 · Mar 9, 2023
• CVE-2023-0621 Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e.High 7.8 · Mar 9, 2023
• CVE-2022-2642 Horner Automation’s RCC 972 firmware version 15.40 contains global variables.High 7.5 · Dec 2, 2022
• CVE-2022-2641 Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device.Critical 9.8 · Dec 2, 2022
• CVE-2022-2640 The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering.High 7.5 · Dec 2, 2022
• CVE-2022-3377 Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data.High 7.8 · Nov 15, 2022
• CVE-2022-3379 Horner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data.High 7.8 · Oct 27, 2022
• CVE-2022-3378 Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data.High 7.8 · Oct 27, 2022