ZeroHour

CVE-2026-81822

Weak Password Hashing in PIMBoards Enables Local Brute-Force Privilege Escalation

CVSS 4.0
8.3 high
EPSS
<1%p1
Published
()
Modified
AI analysis

CVE-2026-81822 is a weak-cryptography flaw (CWE-327) in PIMBoards: users' app-native passwords are stored in project files using a hashing scheme susceptible to computational brute-forcing. An attacker who gains read access to PIMBoards project files (rated as a local attack vector requiring only low privileges and no user interaction) can extract the stored hashes and crack them offline. Recovering a password can potentially elevate the attacker to a PIMBoards administrator account, with high confidentiality impact on the system and subsequent systems per the CVSS 4.0 vector. Any deployment where unauthorized users, shared storage, or backups expose PIMBoards project files is affected; the source data does not specify affected versions or ranges. There is no known exploitation: the flaw has a 0.1% EPSS score (1st percentile), no public proof-of-concept, and is not listed in CISA KEV.

What to do: Restrict read access to PIMBoards project files via file-system permissions, shared-folder ACLs, and backup placement so only authorized users can reach the stored hashes, and require long, strong app-native passwords to make brute-forcing impractical. No fixed version is specified in the source data, so monitor CISA ICS-CERT and the vendor for a patched release, and rotate any passwords whose hashes may have been exposed in project files.

Affected
PIMBoards
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.

Weakness
CWE-327
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

In the news

AVEVA Pipeline Integrity Monitor

CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.

CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.