The vulnerability is a HTTP Host header flaw that is exploitable through the /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout endpoints of the WebClient and WebScheduler web applications in PcVue versions 15.0.0 to 16.3.3. The flaw allows a remote attacker to inject crafted payloads that manipulate server‑side behavior, potentially leading to unauthorized actions or code execution on the control system server. Based on the description, it is inferred that the attacker could achieve unauthorized actions and possibly execute code, although this is not explicitly confirmed.

Affected products are PcVue control system applications sold by arcinfo and arcinformatique. Version ranges include PcVue 15.0.0 through 16.3.3, inclusive. The vulnerability targets the WebClient and WebScheduler web apps that are deployed on an IIS web server.

The CVSS score of 5.3 indicates moderate risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits have been reported. Exploitation would require network access to the affected web servers and sending malicious Host header values; remediation mainly involves applying the vendor‑provided patch or disabling the vulnerable components.