CVE-2026-16462

The CVSS 9.8 score on this PROCON-WEB SCADA SQL injection vulnerability tells only half the story. The EPSS probability of 0.00439 places it in the 24th percentile for exploitation likelihood—and this gap is the analytically significant part, not the severity score alone. PROCON-WEB's GetGridData endpoint accepts arbitrary SQL queries with no authentication required. This isn't a case of broken authentication—the endpoint was almost certainly designed under an assumption that it would never be network-reachable. SCADA developers historically built web interfaces for internal monitoring behind industrial firewalls, treating the network boundary as the security boundary. When these interfaces end up internet-facing due to IT/OT convergence, the result is exactly this class of vulnerability: code that made sense within a deployment topology that no longer exists. The practical question isn't whether CVSS 9.8 justifies patching—it does. The question is whether your deployment is actually exposed. If PROCON-WEB is behind a properly air-gapped control network with no inbound paths, the EPSS probability may accurately reflect low real-world risk. But if the HMI is accessible from corporate networks or directly internet-facing, this vulnerability is trivially exploitable with any SQL injection tool. Modern ICS frameworks like PLCscan have collapsed the domain knowledge barrier. Equally important: determine whether your PROCON-WEB database contains control-layer data—alarm thresholds, tag configurations, or PLC parameter records. In many SCADA historian architectures, the database IS the bridge to the control layer. Arbitrary SQL execution that can INSERT or UPDATE these tables becomes a process manipulation vector, not merely a data breach. Check your schema. Detection is the other gap. Most PROCON-WEB installations run on Windows with minimal SIEM integration for OT traffic. Exploitation will surface in database transaction logs before it surfaces anywhere else. If you're not actively monitoring those logs, exploitation could proceed undetected. Prioritise: audit your PROCON-WEB exposure immediately, verify whether your database schema bridges to control parameters, and instrument database logging if it doesn't already exist. The EPSS score may reflect outdated assumptions about SCADA air-gapping—it doesn't reflect the current IT/OT convergence reality.

Reviewed through automated stages and approved by a human before publication.