Description
HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.
Published: 2026-02-26
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive server configuration disclosure via HTTP headers
Action: Apply Patch
AI Analysis

Impact

HTTP headers added by the default IIS and ASP.NET configuration for PcVue WebVue, WebScheduler, TouchVue and SnapVue services expose unnecessary sensitive information about the server configuration. This disclosure does not directly allow code execution or denial of service, but it provides an attacker with details that could aid in further exploitation. The weakness corresponds to CWE-201. The potential impact is primarily confidentiality of deployment details, with low likelihood of immediate compromise.

Affected Systems

The vulnerability affects PcVue installations from version 12.0.0 through 16.3.3, inclusive. ARC Informatique’s PcVue product contains the related ASP.NET components that emit the headers. Versions 16.3.4 and 15.2.14 provide a patched release that removes the exposed headers; any earlier releases remain affected.

Risk and Exploitability

The CVSS score is 2.3, indicating low severity. EPSS is less than 1 %, showing a very low likelihood of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred that the attack vector is remote, via HTTP requests to the affected web services. Without further exploitation, the risk remains low, but the exposed information could assist attackers in planning subsequent attacks.

Generated by OpenCVE AI on April 16, 2026 at 16:08 UTC.

Remediation

Vendor Solution

Harden the configuration Who should apply this recommendation: All users To reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures: * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. Uninstall the Web Server Who should apply this recommendation: All users not using the affected component If your system does not require the use of the Web & Mobile features, you should make sure not to install them. If your system requires the use of the Web & Mobile features, they should be installed only on the Web Server. See the product help related to the installation for more information. Update IIS configuration – manually update HTTP headers Who should apply this recommendation: All users running affected components. As a quick mitigation for the unnecessary and missing HTTP headers, you can disable default headers and add secure HTTP headers for all requests. Those options can be set via the web.config file located on the IIS by following those steps: * Open the file C:\inetpub\<SV Website>\web.config * Add the following entries to the section customHeaders, which are the recommendations from the official OWASP site: <remove name="X-Powered-By" /> <add name="X-Frame-Options" value="DENY" /> <add name="X-XSS-Protection" value="0" /> <add name="X-Content-Type-Options" value="nosniff" /> <add name="X-DNS-Prefetch-Control" value="off" /> <add name="Cross-Origin-Opener-Policy" value="same-origin" /> <add name="Cross-Origin-Embedder-Policy" value="require-corp" /> <add name="Cross-Origin-Resource-Policy" value="same-site" /> <add name="Referrer-Policy" value="strict-origin-when-cross-origin" /> <add name="Strict-Transport-Security" value="max-age=63072000; includeSubDomains; preload" /> <add name="Permissions-Policy" value="geolocation=(), camera=(), microphone=()" /> Update the Web Deployment Console (WDC) and re deploy the Web Server Who should apply this recommendation: All users running affected components. Install a patched release of the Web Deployment Console (WDC) on the IIS Web server and use it to re-deploy the Web Site. Some settings might need to be updated if third-party web apps or services depend on the OAuth ROPC flow. In a patched release of the WDC, new settings are available for each authorized Client to enable or disable: * The Authorization Code flow * The Authorization Code flow with PKCE * The Resource Owner Password Credentials (ROPC) flow By default, all the OAuth flows are now disabled for third-party web apps and need to be manually enabled before deployment if required. To verify that the patch is applied correctly, you must check that: * The File version property of the file ./bin/Modules/WebDeployment/WebDeploymentConsole.exe matches the deployed release or later, and ensure that any earlier release is no longer used; * Web Sites have been redeployed; * OAuth flow are correctly set for each authorized Client. Available patches: Patch provided in: * PcVue 16.3.4 (16.3.4902.3112) * PcVue 15.2.14 (15.2.14900.37147)

OpenCVE Recommended Actions

  • Update PcVue to a patched release (e.g., 16.3.4 or newer) to eliminate the default header exposure.
  • Redeploy the web site with the updated Web Deployment Console, ensuring the OAuth flows are disabled or correctly configured for each authorized client.
  • Modify the web.config file on the IIS server to remove unnecessary default headers and add secure HTTP headers such as X‑Frame‑Options, X‑Content‑Type‑Options, HSTS, and a strict Referrer‑Policy as recommended by OWASP.
  • Uninstall the Web Server if the system does not require Web & Mobile features; otherwise, ensure it is installed only on the designated Web Server.

Generated by OpenCVE AI on April 16, 2026 at 16:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.pcvue.com/security/#SB2026-2 cve-icon cve-icon
History

Thu, 12 Mar 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Arcinformatique
Arcinformatique pcvue
CPEs cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*
Vendors & Products Arcinformatique
Arcinformatique pcvue
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Thu, 26 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Feb 2026 08:15:00 +0000

Type Values Removed Values Added
Description HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.
Title Server configuration details in HTTP headers
First Time appeared Arcinfo
Arcinfo pcvue
Weaknesses CWE-201
CPEs cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*
cpe:2.3:a:arcinfo:pcvue:12.0.0:*:*:*:*:*:*:*
Vendors & Products Arcinfo
Arcinfo pcvue
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear'}

Subscriptions

Arcinfo Pcvue
Arcinformatique Pcvue
cve-icon MITRE

Status: PUBLISHED

Assigner: arcinfo

Published:

Updated: 2026-03-26T08:22:30.221Z

Reserved: 2026-01-30T08:37:56.659Z

Link: CVE-2026-1694

cve-icon Vulnrichment

Updated: 2026-02-26T14:22:07.242Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-26T08:16:18.763

Modified: 2026-03-12T14:25:17.500

Link: CVE-2026-1694

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T16:15:08Z

Weaknesses