Lucene search

IcscertCVE-2019-13553

HistoryOct 25, 2019 - 6:15 p.m.

CVE-2019-13553

2019-10-2518:15:10

CWE-798

icscert

web.nvd.nist.gov

141

cve-2019-13553

rittal

chiller

sk 3232-series

web interface

carel pcoweb firmware

authentication

hard-coded credentials

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

61.7%

JSON

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.

Affected configurations

Nvd

Node

carelpcoweb_firmwareRangea1.5.3–b1.2.4

AND

rittalchiller_sk_3232Match-

VendorProductVersionCPE
carelpcoweb_firmware*cpe:2.3:o:carel:pcoweb_firmware:*:*:*:*:*:*:*:*
rittalchiller_sk_3232-cpe:2.3:h:rittal:chiller_sk_3232:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
carel	pcoweb_firmware	*	cpe:2.3:o:carel:pcoweb_firmware::::::::
rittal	chiller_sk_3232	-	cpe:2.3:h:rittal:chiller_sk_3232:-:::::::*

CNA Affected

[
  {
    "product": "Rittal Chiller SK 3232-Series",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2019/Oct/45

www.us-cert.gov/ics/advisories/icsa-19-297-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

61.7%

JSON

Related for CVE-2019-13553