A critical (CVSS 9.8) SQL injection flaw in the GetGridData endpoint of Weidmueller Interface's PROCON-WEB SCADA lets remote, unauthenticated attackers execute arbitrary SQL commands against the backend database.
What Is It
CVE-2026-16462 is an improper neutralization of special elements used in an SQL command (CWE-89) affecting PROCON-WEB SCADA. The GetGridData endpoint fails to properly sanitize input, allowing a remote unauthenticated attacker to execute arbitrary SQL commands against the backend database.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). Both scorings agree on the core exploitability profile: network-reachable, low attack complexity, no privileges required, no user interaction.
Why It Matters
Every barrier that normally slows an attacker is absent here. Exploitation requires no credentials, no user interaction, and no unusual conditions; just network reach to the affected endpoint. Confidentiality, integrity, and availability impacts are all rated HIGH, meaning a successful attack can read, alter, or destroy data in the SCADA backend.
This is industrial control software. SQL injection against a supervisory control platform puts the data layer that operators and processes depend on directly in reach of an anonymous attacker.
The CVSS 4.0 exploit maturity field is NOT_DEFINED, and the source material carries no report of exploitation in the wild. Treat that as an absence of evidence rather than evidence of absence: the record is days old, and exploitation status can change without notice.
What's Vulnerable
- Vendor: Weidmueller Interface
- Product: PROCON-WEB SCADA
- Affected versions: 1.0.0 through 6.11.2 (inclusive, semver)
- Default status for other versions: unaffected
Patch Status
The CVE record was published 2026-07-28 and currently carries a vulnerability status of "Received," meaning NVD analysis is not yet complete. No fixed version or required remediation action is specified in the supplied source data. The vulnerability was reported by CERT@VDE ([email protected]), and the associated advisory VDE-2026-085 is the authoritative source for vendor remediation guidance; operators running affected versions should consult it directly.
In the interim, the exposure to reduce is network reachability: affected PROCON-WEB SCADA instances should not be accessible from untrusted networks, and access to the GetGridData endpoint should be restricted to known operator networks.
Sources
- NVD, CVE-2026-16462: https://nvd.nist.gov/vuln/detail/CVE-2026-16462
- CERT@VDE Advisory VDE-2026-085: https://www.certvde.com/en/advisories/VDE-2026-085/