Hydrosystem Control flaws risk full takeover
Three vulnerabilities in Hydrosystem Control System let attackers steal logged credentials, bypass authorization, and inject SQL to potentially seize full database control.
CERT Polska coordinated disclosure of three vulnerabilities in Hydrosystem Control System, an industrial control platform. CVE-2026-4901 causes the system to log sensitive data including user credentials, which combined with CVE-2026-34184's missing directory authorization could let an unauthenticated attacker read those logs and harvest login credentials. CVE-2026-34184 also allows unauthorized attackers to read and execute files in unprotected directories, including running arbitrary PHP scripts directly against the connected database.
CVE-2026-34185 describes widespread SQL injection across most scripts and input parameters, allowing an authenticated attacker to run arbitrary SQL commands and potentially gain full control of the backend database. Chained together, these three issues present a path from unauthenticated log access to credential theft, unauthorized file execution, and full database compromise. The vendor has fixed all three issues in version 9.8.5, and the report credits researcher Jarosław Kamiński of Securitum for the responsible disclosure. No active exploitation has been reported.
Mentioned in this report
Detection guidance
Hydrosystem Control Unauthenticated Log Access
Detects unauthenticated HTTP requests accessing Hydrosystem Control log directories without proper authorization headers, enabling credential harvesting. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Hydrosystem Control Unauthenticated Log Access
description: Detects unauthenticated HTTP GET/POST requests to Hydrosystem Control
log file paths without Authorization or authentication tokens, consistent with CVE-2026-34184
directory traversal and CVE-2026-4901 credential logging.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: proxy
product: generic
detection:
selection:
http_method:
- GET
- POST
uri_path|contains:
- /logs/
- /log/
- /var/log/
uri_path|endswith:
- .log
- .txt
filter_authenticated:
http_headers|contains:
- Authorization
- X-Auth-Token
- Cookie|contains=session
condition: selection and not filter_authenticated
falsepositives:
- Legitimate monitoring agents querying log endpoints with Bearer tokens in querystring
instead of headers
- Automated log aggregation tools configured to bypass header-based auth
level: high
id: 248d70ff-e120-59d3-83b9-5730d7a75dae
status: experimental
author: Vorant
Hydrosystem Control Arbitrary PHP Script Execution
Detects HTTP requests to Hydrosystem Control unprotected directories executing arbitrary PHP scripts against the database, exploiting missing authorization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Hydrosystem Control Arbitrary PHP Script Execution
description: Detects HTTP requests to Hydrosystem Control PHP script paths in unprotected
directories without authentication, consistent with CVE-2026-34184 allowing direct
file execution and database command chaining.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
http_method:
- GET
- POST
uri_path|contains:
- /upload/
- /tmp/
- /temp/
uri_path|endswith: .php
http_response_status_code: '200'
filter_authenticated:
http_headers|contains:
- Authorization
- X-Auth-Token
- Cookie|contains=session
condition: selection and not filter_authenticated
falsepositives:
- Legitimate API endpoints serving PHP files in public directories with implicit auth
via IP whitelist
- Development/test environments with intentionally open PHP directories
level: high
id: 48d2542b-27a7-5aae-ac51-3b13107fba6c
status: experimental
author: Vorant
Hydrosystem Control SQL Injection in Request Parameters
Detects HTTP requests containing SQL injection payloads targeting Hydrosystem Control script parameters, exploiting CVE-2026-34185 for unauthorized database access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Hydrosystem Control SQL Injection in Request Parameters
description: Detects HTTP GET/POST requests to Hydrosystem Control endpoints containing
SQL injection metacharacters and keywords in request parameters, consistent with
CVE-2026-34185 widespread SQL injection across input fields.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: proxy
product: generic
detection:
selection:
http_method:
- GET
- POST
uri_path|contains:
- hydrosystem
request_body|contains:
- ''' OR '''
- ''' OR 1=1'
- UNION SELECT
- DROP TABLE
- INSERT INTO
- DELETE FROM
http_response_status_code:
- '200'
- '500'
filter_logged_in:
http_headers|contains:
- Authorization
- X-Auth-Token
condition: selection and not filter_logged_in
falsepositives:
- Security testing/WAF validation against the application with valid auth headers
- Legitimate query parameters containing SQL-like strings in encoded form
level: high
id: b444b017-254e-5780-83e7-6096d29ab9af
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4901
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free