CVE-2026-16462: SQL Injection in Weidmüller PROCON-WEB SCADA
TL;DR - Critical unauthenticated SQL injection in PROCON-WEB SCADA
GetGridData. - Internet-exposed or reachable SCADA management instances should be treated as high risk. - Patch status and exact fixed version are not confirmed from available sources, so defenders should isolate and monitor immediately.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-16462 |
| CVSS | 9.8 Critical |
| Attack vector | Remote over network |
| Privileges required | None |
| Patch available | Not conclusively confirmed from retrieved primary-source text |
CVE-2026-16462 is described by NVD as a SQL injection flaw in Weidmüller PROCON-WEB SCADA. The vulnerable component is the GetGridData endpoint, which is not properly sanitized. According to the NVD description, a remote unauthenticated attacker can execute arbitrary SQL commands against the backend database.
For practitioners, the main takeaway is straightforward: this is a pre-auth network-reachable injection issue in a SCADA application. Even when public exploit code is not yet known, a flaw with these characteristics warrants urgent review because exposure of the application to untrusted networks materially increases risk. In operational environments, compromise of the database tier can affect process visibility, stored operational data, user records, and application integrity.
What Is This Vulnerability?
The root cause is improper sanitization of user-controlled input reaching the GetGridData endpoint. That behavior is consistent with SQL injection, commonly mapped to CWE-89. In practical terms, the application appears to accept attacker-controlled input and pass it into database queries without sufficient validation or parameterization, allowing database commands to be altered.
In a SCADA context, SQL injection can have consequences beyond ordinary business application exposure. Even if the vulnerable component is “just” the web management layer, backend database access can expose historian-style data, account metadata, project configuration, and application state. Depending on how the product is deployed and what privileges the application database account holds, attackers may be able to read sensitive records, alter data, or disrupt application functions. The public description supports arbitrary SQL command execution, which should be treated as high impact until proven otherwise.
Technical Notes
A simplified example of the underlying anti-pattern looks like this:
SELECT * FROM grid_data WHERE id = '<user_input>';
If input is concatenated directly into SQL rather than bound as a parameter, attacker input can change query logic:
' OR 1=1--
Or, depending on backend behavior and permissions, attempt stacked or time-based execution patterns:
1'; WAITFOR DELAY '0:0:5'--
The exact database engine and server-side query implementation have not been confirmed in the retrieved sources, so defenders should not assume a specific syntax will be required by an attacker. What matters operationally is that unauthenticated input appears able to influence SQL execution.
Who Is Affected?
The confirmed affected product is Weidmüller PROCON-WEB SCADA. That product identification is supported by the CERT@VDE advisory title and Weidmüller product pages. However, the exact affected version range was not disclosed in the retrieved primary-source text available for this article.
This is important because defenders often want a precise “from version X to version Y” statement before taking action. In this case, that precision is not currently available from the source material provided. A Weidmüller release page lists PROCON-WEB Version 6.11.2 as a current release as of June 2026, but that alone does not prove that versions before 6.11.2 are vulnerable, nor that 6.11.2 is the first fixed release, nor even that 6.11.2 is unaffected. Because of that uncertainty, the defensible guidance is to treat all deployed PROCON-WEB SCADA instances as potentially affected until vendor documentation confirms otherwise.
If you operate multiple environments, prioritize instances that are externally reachable, connected across IT/OT trust boundaries, or accessible by contractor networks and jump hosts. Also prioritize servers with direct database access, default application exposure on Windows hosts, or roles tied to visualization, project management, and historian-style data access. In the absence of confirmed version bounds, asset inventory and network exposure review become the first control points.
CVSS Score Breakdown
The base score is 9.8 (Critical). Even without the full vector string present in the returned NVD tool output, the public description strongly implies the score is driven by several factors that align with a worst-case web application injection issue: network reachability, no authentication requirement, low attack complexity, and high potential impact to confidentiality, integrity, and availability.
A remote unauthenticated SQL injection usually scores highly because it removes two common friction points for attackers: local access and credentials. If an attacker can send crafted requests directly to the vulnerable endpoint and influence backend SQL execution, the barrier to entry is low. In an ICS or SCADA management environment, that matters even more because the downstream impact can extend beyond ordinary web compromise into operational data integrity and operator trust in the management plane.
From a prioritization standpoint, a 9.8 score should push this issue into the same queue as other pre-auth remote code execution and injection flaws, even though this is SQL injection rather than memory corruption. For defenders, the practical meaning is not “panic,” but “treat as an urgent internet-facing application exposure issue and reduce reachability first if patch guidance is unclear.”
Exploitation Status
At the time of this writing, there is no confirmed evidence in the provided sources that CVE-2026-16462 is being exploited in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog based on the supplied lookup, which means there is no KEV dateAdded, dueDate, or required-action directive tied to this issue at present.
Likewise, no credible public proof-of-concept specific to CVE-2026-16462 was identified in the retrieved results. That does not reduce the need for action. SQL injection against a named endpoint is the kind of vulnerability class that can often be reproduced quickly by capable attackers once an advisory names the vulnerable function. When neither public PoC nor active exploitation is confirmed, defenders should assume the window before opportunistic testing may be short, especially for internet-reachable administrative applications.
Operationally, the right statement is: PoC status unknown/no credible public PoC found in available sources; active exploitation not confirmed; in-the-wild exploitation not confirmed. In the absence of stronger telemetry, assume exploit development is feasible and prioritize containment accordingly.
How to Detect It
Detection should focus on inbound requests to the PROCON-WEB SCADA web application, especially those targeting the GetGridData endpoint with suspicious metacharacters, boolean conditions, comment markers, stacked-query attempts, or unusual response timing. Because the vulnerability is pre-auth by description, requests may come from unauthenticated sessions or have no corresponding successful login events.
You should also look for downstream evidence at the database and application layers. Useful signals include query failures tied to malformed input, spikes in 500-series responses, repeated requests to the same endpoint with small parameter variations, and time-based probing patterns such as requests that consistently delay responses. In OT environments, also review remote access logs, jump server logs, VPN telemetry, and reverse proxy or WAF records for connections into the SCADA management subnet.
Technical Notes
Example web log indicators to hunt for:
GET /.../GetGridData?...%27%20OR%201%3D1-- HTTP/1.1
GET /.../GetGridData?...UNION%20SELECT...
GET /.../GetGridData?...WAITFOR%20DELAY...
GET /.../GetGridData?...%27%3BSELECT...
Example grep for access logs if the endpoint name is logged in plaintext:
grep -Ei "GetGridData|union select|or 1=1|waitfor delay|--|%27|%3B" /var/log/nginx/access.log
Example Splunk search for suspicious requests:
index=web_logs ("GetGridData")
| search uri_query="*%27*" OR uri_query="*'*" OR uri_query="*UNION*SELECT*" OR uri_query="*OR*1=1*" OR uri_query="*WAITFOR*DELAY*" OR uri_query="*--*"
| stats count by src_ip, http_method, uri_path, uri_query, status
Example Suricata-style HTTP signature concept for tuning and validation:
alert http any any -> $HOME_NET any (
msg:"Possible SQLi attempt to PROCON-WEB GetGridData";
flow:to_server,established;
http.uri; content:"GetGridData"; nocase;
pcre:"/(|\'|\bUNION\b|\bSELECT\b|\bOR\b.+\=.+\b|\-\-|\u003B|\bWAITFOR\b)/i";
sid:10016462; rev:1;
)
These are detection examples, not exploit confirmation. Tune them to your actual URI paths, reverse proxy logging format, and expected application behavior to reduce false positives.
Mitigation and Patching
At the time of writing, a confirmed fixed version is not available in the retrieved primary-source text. Although Weidmüller’s releases page lists PROCON-WEB Version 6.11.2, there is no source-backed confirmation here that 6.11.2 is the remediation release for CVE-2026-16462. For that reason, you should avoid claiming a specific patch level as definitive unless your team verifies it directly from current vendor advisory language or release notes.
In the absence of a confirmed fix version, the immediate mitigation priority is exposure reduction. Restrict network access to PROCON-WEB SCADA management interfaces so only authorized administration workstations, jump hosts, or VPN segments can reach them. If the system is internet-exposed, remove direct exposure. Place the application behind an allowlist-enabled reverse proxy or firewall policy where feasible. If a WAF is available, add temporary signatures aimed at SQLi patterns targeting GetGridData, while recognizing that WAF rules reduce risk but are not a substitute for remediation.
If your organization has confirmed with the vendor that 6.11.2 or a later build contains the fix, document that confirmation internally before rollout. If you do not have that confirmation, the safest statement is: upgrade to the latest vendor-supported release after validating with Weidmüller whether that release addresses CVE-2026-16462.
Technical Notes
Example temporary network restriction using a reverse proxy allowlist pattern:
location / {
allow 10.20.30.0/24;
allow 10.40.50.10;
deny all;
proxy_pass http://proconweb_backend;
}
Example Linux firewall restriction pattern if the application is fronted on a host-based interface:
iptables -A INPUT -p tcp --dport 80 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Example WAF-style blocking logic for obvious injection probes to the vulnerable endpoint:
If request URI contains "GetGridData" and query/body contains:
' or union select -- ; waitfor delay
then block and alert.
Upgrade command syntax for PROCON-WEB SCADA is not available in the provided sources, so it would be inappropriate to invent a vendor-specific upgrade CLI. Defenders should follow their established PROCON-WEB deployment method and only execute vendor-documented upgrade steps after verifying which release fixes this CVE. Until then, compensating controls and segmentation are the priority.
References
The primary public description identifies this as a critical SQL injection in GetGridData affecting Weidmüller PROCON-WEB SCADA. The most useful references for validation, tracking, and vendor follow-up are below.
Use the vendor and CERT advisory pages to verify whether version range and remediation guidance have been updated since publication. This is especially important here because the currently available source set does not conclusively state the fixed version.
- NVD entry for CVE-2026-16462
- CERT@VDE advisory: https://www.certvde.com/en/advisories/VDE-2026-085/
- Weidmüller GTI Software releases page: https://www.weidmueller-gti-software.com/en/services/releases/index.jsp
- Weidmüller PROCON-WEB SCADA product page: https://www.weidmueller-gti-software.com/en/software/hmi_scada/hmi_scada_main_page.jsp
- CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
If you run PROCON-WEB SCADA, the practical course is to verify exposure, tighten access immediately, monitor GetGridData traffic for injection attempts, and obtain direct vendor confirmation on the fixed version before closing the issue.
For further reading on related vulnerabilities and protective measures, check out our articles on CVE-2023-54352 and How to Protect Meeting Recordings and Transcripts: Practical Controls That Work.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.