Lucene search

[email protected]CVE-2019-9010

HistoryAug 15, 2019 - 6:15 p.m.

CVE-2019-9010

2019-08-1518:15:23

[email protected]

web.nvd.nist.gov

cve-2019-9010

codesys

communication channel

security vulnerability

3s-smart

nvd

ownership verification

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.8%

JSON

An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.

Affected configurations

NVD

Node

codesyscontrol_for_beaglebone_slRange3.0–3.5.14.20

codesyscontrol_for_empc-a\/imx6_slRange3.0–3.5.14.20

codesyscontrol_for_iot2000_slRange3.0–3.5.14.20

codesyscontrol_for_linux_slRange3.0–3.5.14.20

codesyscontrol_for_pfc100_slRange3.0–3.5.14.20

codesyscontrol_for_pfc200_slRange3.0–3.5.14.20

codesyscontrol_for_raspberry_pi_slRange3.0–3.5.14.20

codesyscontrol_runtime_toolkitRange3.0–3.5.14.20

codesysdevelopment_systemRange3.0–3.5.14.20

codesysgatewayRange3.0–3.5.14.20

CPENameOperatorVersion
codesys:control_for_beaglebone_slcodesys control for beaglebone sllt3.5.14.20
codesys:control_for_empc-a\/imx6_slcodesys control for empc-a/imx6 sllt3.5.14.20
codesys:control_for_iot2000_slcodesys control for iot2000 sllt3.5.14.20
codesys:control_for_linux_slcodesys control for linux sllt3.5.14.20
codesys:control_for_pfc100_slcodesys control for pfc100 sllt3.5.14.20
codesys:control_for_pfc200_slcodesys control for pfc200 sllt3.5.14.20
codesys:control_for_raspberry_pi_slcodesys control for raspberry pi sllt3.5.14.20
codesys:control_runtime_toolkitcodesys control runtime toolkitlt3.5.14.20
codesys:development_systemcodesys development systemlt3.5.14.20
codesys:gatewaycodesys gatewaylt3.5.14.20

CPE	Name	Operator	Version
codesys:control_for_beaglebone_sl	codesys control for beaglebone sl	lt	3.5.14.20
codesys:control_for_empc-a\/imx6_sl	codesys control for empc-a/imx6 sl	lt	3.5.14.20
codesys:control_for_iot2000_sl	codesys control for iot2000 sl	lt	3.5.14.20
codesys:control_for_linux_sl	codesys control for linux sl	lt	3.5.14.20
codesys:control_for_pfc100_sl	codesys control for pfc100 sl	lt	3.5.14.20
codesys:control_for_pfc200_sl	codesys control for pfc200 sl	lt	3.5.14.20
codesys:control_for_raspberry_pi_sl	codesys control for raspberry pi sl	lt	3.5.14.20
codesys:control_runtime_toolkit	codesys control runtime toolkit	lt	3.5.14.20
codesys:development_system	codesys development system	lt	3.5.14.20
codesys:gateway	codesys gateway	lt	3.5.14.20

References

customers.codesys.com/index.php?eID=dumpFile&t=f&f=12937&token=769045a17015bea00ec7ff313de8f1a5c73e7b93&download=

www.us-cert.gov/ics/advisories/icsa-19-213-03

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.8%

JSON

Related for CVE-2019-9010

prion1 cvelist1 nvd1 ics1 nessus1