7.8

CVE-2020-12069

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pilz ≫ Pmc Version >= 3.0.0 < 3.5.17
Codesys ≫ Control For Beaglebone Version < 3.5.16.0
Codesys ≫ Control For Iot2000 Version < 3.5.16.0
Codesys ≫ Control For Linux Version < 3.5.16.0
Codesys ≫ Control For Pfc100 Version < 3.5.16.0
Codesys ≫ Control For Pfc200 Version < 3.5.16.0
Codesys ≫ Control For Plcnext Version < 3.5.16.0
Codesys ≫ Control For Raspberry Pi Version < 3.5.16.0
Codesys ≫ Control Rte V3 Version < 3.5.16.0
Codesys ≫ Control Win V3 Version < 3.5.16.0
Codesys ≫ Hmi V3 Version < 3.5.16.0
Codesys ≫ V3 Simulation Runtime Version < 3.5.16.0
Festo ≫ Controller Cecc-d Firmware Version2.3.8.0
   Festo ≫ Controller Cecc-d Version-
Festo ≫ Controller Cecc-d Firmware Version2.3.8.1
   Festo ≫ Controller Cecc-d Version-
Festo ≫ Controller Cecc-lk Firmware Version2.3.8.0
   Festo ≫ Controller Cecc-lk Version-
Festo ≫ Controller Cecc-lk Firmware Version2.3.8.1
   Festo ≫ Controller Cecc-lk Version-
Festo ≫ Controller Cecc-s Firmware Version2.3.8.0
   Festo ≫ Controller Cecc-s Version-
Festo ≫ Controller Cecc-s Firmware Version2.3.8.1
   Festo ≫ Controller Cecc-s Version-
Wago ≫ 750-8217 Firmware Version-
   Wago ≫ 750-8217 Version-
Wago ≫ 750-8216 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8216 Version-
Wago ≫ 750-8215 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8215 Version-
Wago ≫ 750-8214 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8214 Version-
Wago ≫ 750-8213 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8213 Version-
Wago ≫ 750-8212 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8212 Version-
Wago ≫ 750-8211 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8211 Version-
Wago ≫ 750-8210 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8210 Version-
Wago ≫ 750-8207 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8207 Version-
Wago ≫ 750-8206 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8206 Version-
Wago ≫ 750-8204 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8204 Version-
Wago ≫ 750-8203 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8203 Version-
Wago ≫ 750-8202 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8202 Version-
Wago ≫ 750-8102 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8102 Version-
Wago ≫ 750-8101 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8101 Version-
Wago ≫ 750-8100 Firmware Version < 03.06.19\(18\)
   Wago ≫ 750-8100 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.079
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
info@cert.vde.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-916 Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.