CVE-2020-12069

Summary

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Affected Software

Weaknesses

• CWE-916: CWE-916 Use of Password Hash With Insufficient Computational Effort

ADP Enrichment

CVE Program Container

Additional References

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=
• https://cert.vde.com/en/advisories/VDE-2021-061/
• https://cert.vde.com/en/advisories/VDE-2022-031/
• https://cert.vde.com/en/advisories/VDE-2022-022/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=
• https://cert.vde.com/en/advisories/VDE-2021-061/
• https://cert.vde.com/en/advisories/VDE-2022-031/
• https://cert.vde.com/en/advisories/VDE-2022-022/

• ←Previous
• Next→