Lucene search

TalosCVE-2019-5106

HistoryMar 11, 2020 - 10:27 p.m.

CVE-2019-5106

2020-03-1122:27:39

CWE-798

talos

web.nvd.nist.gov

cve-2019-5106

wago e!cockpit

authentication

encryption key

vulnerability

nvd

codesys gateway

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text.

Affected configurations

Nvd

Vulners

Node

wagoe\!cockpitMatch1.5.1.1

VendorProductVersionCPE
wagoe\!cockpit1.5.1.1cpe:2.3:a:wago:e\!cockpit:1.5.1.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wago	e\!cockpit	1.5.1.1	cpe:2.3:a:wago:e\!cockpit:1.5.1.1:::::::*

CNA Affected

[
  {
    "product": "WAGO e!Cockpit",
    "vendor": "Wago",
    "versions": [
      {
        "status": "affected",
        "version": "1.5.1.1"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2019-0898

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

20.2%

JSON

Related for CVE-2019-5106