Server configuration details in HTTP headers

Description

HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.

Scores

EPSS (exploitation in 30 days)

0.20% · top 90% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.

Weakness

• CWE-201 Insertion of Sensitive Information into Sent Data (opens in a new tab)All about CWE-201 and its CVEs

Affected products

• arcinfo · PcVue

  • affected 16.0.0 – ≤ 16.3.3
  • affected 15.0.0 – ≤ 15.2.13
  • affected 12.0.0

What to do

Solution: Harden the configuration Who should apply this recommendation: All users To reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures: * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. Uninstall the Web Server Who should apply this recommendation: All users not using the affected component If your system does not require the use of the Web & Mobile features, you should make sure not to install them. If your system requires the use of the Web & Mobile features, they should be installed only on the Web Server. See the product help related to the installation for more information. Update IIS configuration – manually update HTTP headers Who should apply this recommendation: All users running affected components. As a quick mitigation for the unnecessary and missing HTTP headers, you can disable default headers and add secure HTTP headers for all requests. Those options can be set via the web.config file located on the IIS by following those steps: * Open the file C:\inetpub\<SV Website>\web.config * Add the following entries to the section customHeaders, which are the recommendations from the official OWASP site: <remove name="X-Powered-By" /> <add name="X-Frame-Options" value="DENY" /> <add name="X-XSS-Protection" value="0" /> <add name="X-Content-Type-Options" value="nosniff" /> <add name="X-DNS-Prefetch-Control" value="off" /> <add name="Cross-Origin-Opener-Policy" value="same-origin" /> <add name="Cross-Origin-Embedder-Policy" value="require-corp" /> <add name="Cross-Origin-Resource-Policy" value="same-site" /> <add name="Referrer-Policy" value="strict-origin-when-cross-origin" /> <add name="Strict-Transport-Security" value="max-age=63072000; includeSubDomains; preload" /> <add name="Permissions-Policy" value="geolocation=(), camera=(), microphone=()" /> Update the Web Deployment Console (WDC) and re deploy the Web Server Who should apply this recommendation: All users running affected components. Install a patched release of the Web Deployment Console (WDC) on the IIS Web server and use it to re-deploy the Web Site. Some settings might need to be updated if third-party web apps or services depend on the OAuth ROPC flow. In a patched release of the WDC, new settings are available for each authorized Client to enable or disable: * The Authorization Code flow * The Authorization Code flow with PKCE * The Resource Owner Password Credentials (ROPC) flow By default, all the OAuth flows are now disabled for third-party web apps and need to be manually enabled before deployment if required. To verify that the patch is applied correctly, you must check that: * The File version property of the file ./bin/Modules/WebDeployment/WebDeploymentConsole.exe matches the deployed release or later, and ensure that any earlier release is no longer used; * Web Sites have been redeployed; * OAuth flow are correctly set for each authorized Client. Available patches: Patch provided in: * PcVue 16.3.4 (16.3.4902.3112) * PcVue 15.2.14 (15.2.14900.37147)

Exploitation: No POC available.

Exploitation: Not known to be exploited

References (1)

• https://www.pcvue.com/security/#SB2026-2 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-1694](https://trackcve.app/badge/CVE-2026-1694.svg)](https://trackcve.app/cve/CVE-2026-1694)

Record last updated 26 Mar 2026, 08:22 UTC.