The Hydrosystem Control System records user credentials and other sensitive data in its log files, enabling an attacker who can read those logs to obtain privileged access. This information‑exposure flaw, identified as CWE‑532, undermines confidentiality and may facilitate further compromise when combined with other vulnerabilities such as CVE‑2026‑34184.

Hydrosystem Control System versions preceding 9.8.5 are vulnerable; the fix was released in version 9.8.5. Any installation of the control system before that update is affected, regardless of other configuration settings.

With a CVSS v3.1 score of 6.9 the flaw has medium severity and the EPSS score is not available; it is not in the CISA KEV catalog. Exploitation requires access to the log files, which are typically readable by authenticated users, so the threat vector is likely post‑exploitation or lateral movement after an initial compromise such as CVE‑2026‑34184. The risk is primarily loss of confidentiality and potential privilege escalation, while integrity and availability are less directly impacted.