Hydrosystem Control System flaws enable database takeover
Three vulnerabilities in Hydrosystem Control System allow credential theft, unauthorized file access, and SQL injection, enabling full database compromise; fixed in version 9.8.5.
CERT Polska coordinated disclosure of three vulnerabilities in Hydrosystem Control System, a water infrastructure control platform. CVE-2026-4901 exposes user credentials through improper logging of sensitive information. CVE-2026-34184 permits unauthorized directory access due to missing authorization checks, allowing attackers to read files and execute PHP scripts against the database. CVE-2026-34185 is a widespread SQL injection flaw affecting most scripts and parameters, enabling authenticated attackers to execute arbitrary SQL commands.
The vulnerabilities can be chained: an attacker exploiting CVE-2026-34184 can access logs containing credentials from CVE-2026-4901, then leverage those credentials with CVE-2026-34185 to gain full database control. The issues affect water system infrastructure and were responsibly disclosed by Jarosław Kamiński from Securitum. All three vulnerabilities are resolved in version 9.8.5.
Mentioned in this report
Detection guidance
Possible SQL Injection Attempt Against Hydrosystem Control System Scripts
Detects SQL injection payload patterns in web requests targeting Hydrosystem Control System scripts, consistent with CVE-2026-34185 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible SQL Injection Attempt Against Hydrosystem Control System Scripts
id: 00b11846-c830-5e0c-8cec-374018922cc3
status: experimental
description: 'Detects common SQL injection syntax patterns within web request query
strings or POST bodies directed at Hydrosystem Control System endpoints, matching
the widespread unauthenticated/authenticated SQL injection flaw (CVE-2026-34185)
affecting most scripts and parameters.
'
references:
- CERT Polska Hydrosystem Control System advisory
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- UNION SELECT
- ''' OR ''1''=''1'
- OR 1=1
- --+
- SLEEP(
- benchmark(
- ''' AND ''1''=''1'
- information_schema
filter_common:
cs-uri-query|contains:
- search=union
condition: selection and not filter_common
falsepositives:
- Security scanners or penetration testing tools probing the application
- Legitimate queries containing SQL-like keywords in free-text search fields
level: high
tags:
- attack.t1190
- attack.initial_access
Unauthorized Directory or PHP Script Access Attempt on Hydrosystem Control System
Detects path traversal or direct access attempts to internal PHP scripts/directories without proper authorization, consistent with CVE-2026-34184 missing authorization checks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthorized Directory or PHP Script Access Attempt on Hydrosystem Control
System
id: ee9b5064-0433-5be9-8383-585910603e49
status: experimental
description: 'Detects web requests containing path traversal sequences or direct references
to internal/administrative PHP scripts and directories that should require authorization,
matching the missing authorization check vulnerability (CVE-2026-34184) that allows
unauthorized file read and PHP script execution against the database.
'
references:
- CERT Polska Hydrosystem Control System advisory
author: Vorant
logsource:
category: webserver
detection:
selection_traversal:
cs-uri-stem|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
selection_status:
sc-status:
- 200
- 206
condition: selection_traversal and selection_status
falsepositives:
- Vulnerability scanners testing for path traversal
- Misconfigured reverse proxies rewriting legitimate paths with encoded characters
level: high
tags:
- attack.t1190
- attack.initial_access
Web Request Accessing Application Log Files Potentially Containing Credentials
Detects HTTP requests to log file paths or extensions that may expose credentials logged in plaintext, consistent with CVE-2026-4901 improper logging of sensitive information. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Request Accessing Application Log Files Potentially Containing Credentials
id: a326e1d9-cdc2-516d-b858-51a58f68c1ff
status: experimental
description: 'Detects direct HTTP access to log files or log directories that may
contain improperly logged credentials, matching the credential exposure through
logging vulnerability (CVE-2026-4901). This behavior is typically chained after
exploiting a directory access vulnerability to harvest credentials for later authenticated
abuse.
'
references:
- CERT Polska Hydrosystem Control System advisory
author: Vorant
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- .log
- /logs/
- /log/
- debug.log
- error.log
- access.log
selection_status:
sc-status:
- 200
- 206
condition: selection and selection_status
falsepositives:
- Authorized administrators reviewing application logs through a web-based log viewer
- Monitoring or SIEM agents pulling log files over HTTP
level: medium
tags:
- attack.t1552.001
- attack.credential_access
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4901
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free