CVE-2026-16462: SQL Injection Vulnerability in PROCON-WEB SCADA

CVE-2026-16462 identifies a critical SQL Injection vulnerability within Weidmueller Interface's PROCON-WEB SCADA versions up to 6.11.2. The vulnerability stems from improper input sanitization in the 'GetGridData' endpoint, allowing a remote and unauthenticated attacker to execute arbitrary SQL commands. This flaw presents a severe risk for industrial control systems, as successful exploitation could lead to unauthorized data access, modification, or even control over critical SCADA functions. The high CVSS base score of 9.8 indicates the extreme severity, enabling attackers to compromise the integrity and availability of industrial processes. Defenders should prioritize patching and monitoring for exploitation attempts against this endpoint.

Attack Chain

1. An unauthenticated remote attacker identifies a PROCON-WEB SCADA instance with the vulnerable 'GetGridData' endpoint exposed.
2. The attacker crafts a malicious HTTP GET or POST request targeting the vulnerable endpoint, embedding SQL injection payloads within the parameters intended for 'GetGridData'.
3. The PROCON-WEB SCADA application receives the request and, due to insufficient input validation and sanitization, processes the malicious SQL payload directly.
4. The embedded SQL commands are executed by the underlying database, granting the attacker unauthorized access to, or modification of, the SCADA system's database.
5. Depending on the database configuration and attacker's capabilities, this can escalate to arbitrary command execution on the host operating system.
6. The attacker achieves data exfiltration, system control, or disrupts critical industrial processes by manipulating SCADA parameters or injecting malicious commands.

Impact

The impact of successful exploitation of CVE-2026-16462 is critical, primarily due to the nature of SCADA systems often controlling vital industrial processes and critical infrastructure. An attacker could gain unauthorized access to sensitive operational data, manipulate control parameters, or disrupt system availability. This could lead to production downtime, equipment damage, safety hazards, environmental incidents, or financial losses. While no specific number of victims or sectors were reported, any organization utilizing PROCON-WEB SCADA versions 6.11.2 or earlier is susceptible to severe operational and reputational damage.

Recommendation

• Patch CVE-2026-16462 immediately by upgrading Weidmueller Interface PROCON-WEB SCADA to a version greater than 6.11.2, as specified in the CERT VDE advisory.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect attempts to exploit CVE-2026-16462.
• Review webserver logs for unusual HTTP requests to the /GetGridData endpoint, specifically looking for SQL injection patterns in the URI query or request body.