CVEvulnerability

CVE-2020-12069

7.8 HIGH Published 2022-12-26 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2022-12-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-916

Description

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Affected configurations

• pilz pmc (>= 3.0.0 < 3.5.17) • codesys control for beaglebone (< 3.5.16.0) • codesys control for empc-a\/imx6 (< 3.5.16.0) • codesys control for iot2000 (< 3.5.16.0) • codesys control for linux (< 3.5.16.0) • codesys control for pfc100 (< 3.5.16.0) • codesys control for pfc200 (< 3.5.16.0) • codesys control for plcnext (< 3.5.16.0) • codesys control for raspberry pi (< 3.5.16.0) • codesys control rte v3 (< 3.5.16.0) • codesys control v3 runtime system toolkit (< 3.5.16.0) • codesys control win v3 (< 3.5.16.0) • codesys hmi v3 (< 3.5.16.0) • codesys v3 simulation runtime (< 3.5.16.0) • festo controller cecc-d firmware 2.3.8.0 • festo controller cecc-d firmware 2.3.8.1 • festo controller cecc-lk firmware 2.3.8.0 • festo controller cecc-lk firmware 2.3.8.1 • festo controller cecc-s firmware 2.3.8.0 • festo controller cecc-s firmware 2.3.8.1 • wago 750-8217 firmware • wago 750-8216 firmware (< 03.06.19\(18\)) • wago 750-8215 firmware (< 03.06.19\(18\)) • wago 750-8214 firmware (< 03.06.19\(18\)) • wago 750-8213 firmware (< 03.06.19\(18\)) • wago 750-8212 firmware (< 03.06.19\(18\)) • wago 750-8211 firmware (< 03.06.19\(18\)) • wago 750-8210 firmware (< 03.06.19\(18\)) • wago 750-8207 firmware (< 03.06.19\(18\)) • wago 750-8206 firmware (< 03.06.19\(18\)) • wago 750-8204 firmware (< 03.06.19\(18\)) • wago 750-8203 firmware (< 03.06.19\(18\)) • wago 750-8202 firmware (< 03.06.19\(18\)) • wago 750-8102 firmware (< 03.06.19\(18\)) • wago 750-8101 firmware (< 03.06.19\(18\)) • wago 750-8100 firmware (< 03.06.19\(18\)) • wago 762-4201\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-4202\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-4203\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-4204\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-4205\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-4205\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4206\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-4206\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4301\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4302\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4303\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4304\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4305\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-4306\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-5203\/8000-001 firmware (<= 03.06.19\(18\)) • wago 762-5204\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-5205\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-5206\/8000-001 firmware (< 03.06.19\(18\)) • wago 762-5303\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-5304\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-5305\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-5306\/8000-002 firmware (< 03.06.19\(18\)) • wago 762-6201\/8000-001 firmware (<= 03.06.19\(18\)) • wago 762-6202\/8000-001 firmware (< 03.06.19\(18\)) … and 7 more

Related

Weakness · CWE (1)

  • CWE-916 Use of Password Hash With Insufficient Computational Effort weakness

References