An attacker with network access to a Horner Automation PLC can brute‑force the login interface because passwords are weak and no input limiters are applied. This allows the attacker to obtain administrative credentials and then gain unauthorized access to the PLC’s control and monitoring functions, potentially compromising critical industrial processes. The vulnerability is a classic example of Weak Credentials (CWE‑521).

Affected products include Horner Automation Cscape, XL4 PLC, and XL7 PLC. Vendor documentation recommends upgrading to Cscape v10.2 SP2 or later and installing the latest firmware on all XL4 and XL7 PLCs. No specific version numbers are listed in the advisory, so all current releases without these updates are potentially vulnerable.

The CVSS score of 9.3 indicates a critical severity, yet the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires only network connectivity to the PLC and no privileged local access, it is fairly easy for an attacker operating on the same network segment to mount an enumeration attack. With no account lockout or input throttling, brute‑force attempts can succeed quickly, raising the likelihood of exploitation.