SearchSubscribe

TRA-2026-42

Hardcoded maintenance credentials in PLC web interface

A maintenance account with a static password grants write access to ladder logic over the embedded web server.

  • Mitigation available
  • OT & ICS

CVSS 3.1 base score

9.1critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor
Quanta Automation
Product
Q-Series PLC firmware 4.x
CVE
  • CVE-2026-39771
Disclosure
103 days
Researchers
Sofia Brandt, Yuki Tanaka

Score breakdown

Exploitability

Attack vector
Attack complexity
Privileges required
User interaction

Scope

Scope

Impact

Confidentiality
Integrity
Availability

Affected products

ProductAffectedFixed in
Q-Series PLC firmware4.0.0 – 4.6.2No fix yet

Read the research

Questions about this advisory

research@tenable.com
On this page6 sections
  1. Score breakdown
  2. Affected products
  3. Synopsis
  4. Proof of concept
  5. Solution
  6. Disclosure timeline

Synopsis

A maintenance account with a static password grants write access to ladder logic over the embedded web server.

Proof of concept

Tenable has shared a proof of concept with Quanta Automation. It is not published here, to give operators time to apply the fix.

Solution

Restrict access to the PLC web interface to the engineering network and disable it where not needed. Quanta Automation has published a configuration guide that removes the maintenance account from the web role.

Disclosure timeline

  1. Tenable reports the issue to Quanta Automation

  2. TRA-2026-42 published

103 days from report to publication, against a 90-day policy.How we disclose