An insertion of sensitive information into log files occurs in B&R PVI client versions older than 6.5. The problem arises when the logging function, which is disabled by default, is explicitly enabled. An attacker who has already authenticated locally to the client can exploit this to capture credential information processed by the application. The vulnerability is a classic example of CWE‑532, where confidential data is inadvertently recorded in logs.

B&R Industrial Automation GmbH Process Visualization Interface (PVI) client software versions prior to 6.5 are affected. No other vendors or products are listed as impacted.

The CVSS score is 5.1, indicating a moderate risk. The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of widespread exploitation. The attack requires local access and valid user authentication, and it requires the attacker to have granted permission to enable logging. Even in the presence of exploitation, the damage is confined to the local system’s environment, but it could expose credential material to the attacker.