The vulnerability arises from a missing origin validation on the WebSocket endpoints GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect used by PcVue web services. An attacker could lure an authenticated user to a malicious website, leading to potential phishing of credentials or other sensitive information. The flaw does not grant direct code execution but could allow unauthorized access to user‑specific data or services, especially if users act on deceptive links. This weakness aligns with CWE‑1385, reflecting improper origin validation.

Arcinfo PcVue systems with versions 12.0.0 through 16.3.3 are affected. The official fix is available in PcVue 16.3.4 (16.3.4902.3112) and PcVue 15.2.14 (15.2.14900.37147). Versions outside this range are not impacted, and non‑Web Server components can safely remain installed if unused.

The CVSS score of 5.3 indicates a moderate overall risk, and the EPSS score is below 1%, implying a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote through WebSocket connections, typically requiring the system to be reachable over a network where a user is authenticated and may be tricked into visiting a malicious site. Based on the description, credential theft is an inference; the primary risk is phishing of the authenticated user, which might lead to credential leakage if the user discloses information. The impact could extend to unauthorized access if credentials are compromised, but this is contingent on user behavior and system configuration.