CVE-2020-12069

published 2022-12-26

CVE-2020-12069: In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords…

high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Affected

67 ranges · showing 25

Vendor	Product	Version range	Fixed in
codesys	codesys_v3_containing_the_cmpusermgr	>= V3 < V3.5.16.0	V3.5.16.0
codesys	control_for_beaglebone	< 3.5.16.0	3.5.16.0
codesys	control_for_empc-a_imx6	< 3.5.16.0	3.5.16.0
codesys	control_for_iot2000	< 3.5.16.0	3.5.16.0
codesys	control_for_linux	< 3.5.16.0	3.5.16.0
codesys	control_for_pfc100	< 3.5.16.0	3.5.16.0
codesys	control_for_pfc200	< 3.5.16.0	3.5.16.0
codesys	control_for_plcnext	< 3.5.16.0	3.5.16.0
codesys	control_for_raspberry_pi	< 3.5.16.0	3.5.16.0
codesys	control_rte_v3	< 3.5.16.0	3.5.16.0
codesys	control_v3_runtime_system_toolkit	< 3.5.16.0	3.5.16.0
codesys	control_win_v3	< 3.5.16.0	3.5.16.0
codesys	hmi_v3	< 3.5.16.0	3.5.16.0
codesys	v3_simulation_runtime	< 3.5.16.0	3.5.16.0
festo	controller_cecc-d_firmware	—	—
festo	controller_cecc-d_firmware	—	—
festo	controller_cecc-lk_firmware	—	—
festo	controller_cecc-lk_firmware	—	—
festo	controller_cecc-s_firmware	—	—
festo	controller_cecc-s_firmware	—	—
pilz	pmc	>= 3.0.0 < 3.5.17	3.5.17
wago	750-8100_firmware	< 03.06.19\(18\)	03.06.19\(18\)
wago	750-8101_firmware	< 03.06.19\(18\)	03.06.19\(18\)
wago	750-8102_firmware	< 03.06.19\(18\)	03.06.19\(18\)
wago	750-8202_firmware	< 03.06.19\(18\)	03.06.19\(18\)

CWE-916