CVE-2020-12069highCWE-916

CODESYS V3 prone to Inadequate Password Hashing

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.8epss 0.2%

probabilidad de explotación

0.2%top 94% de las CVE

explotación observada

noninguna fuente lo reporta

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

CODESYS · CODESYS V3 containing the CmpUserMgr

Referencias

https://cert.vde.com/en/advisories/VDE-2021-061/https://cert.vde.com/en/advisories/VDE-2022-022/https://cert.vde.com/en/advisories/VDE-2022-031/https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=