Lucene search

[email protected]NVD:CVE-2019-9013

HistoryAug 15, 2019 - 5:15 p.m.

CVE-2019-9013

2019-08-1517:15:13

CWE-327

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.

Affected configurations

Nvd

Node

codesyscontrol_for_beaglebone_slRange3.0–3.5.16.0

codesyscontrol_for_empc-a\/imx6_slRange3.0–3.5.16.0

codesyscontrol_for_iot2000_slRange3.0–3.5.16.0

codesyscontrol_for_linux_slRange3.0–3.5.16.0

codesyscontrol_for_pfc100_slRange3.0–3.5.16.0

codesyscontrol_for_pfc200_slRange3.0–3.5.16.0

codesyscontrol_rte_slRange3.0–3.5.16.0

codesyscontrol_win_slRange3.0–3.5.16.0

codesysdevelopment_systemRange3.0–3.5.16.0

codesyshmi_slRange3.0–3.5.16.0

codesysraspberry_piRange3.0–3.5.16.0

codesysruntime_toolkitRange3.0–3.5.16.0

VendorProductVersionCPE
codesyscontrol_for_beaglebone_sl*cpe:2.3:a:codesys:control_for_beaglebone_sl:*:*:*:*:*:*:*:*
codesyscontrol_for_empc-a\/imx6_sl*cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl:*:*:*:*:*:*:*:*
codesyscontrol_for_iot2000_sl*cpe:2.3:a:codesys:control_for_iot2000_sl:*:*:*:*:*:*:*:*
codesyscontrol_for_linux_sl*cpe:2.3:a:codesys:control_for_linux_sl:*:*:*:*:*:*:*:*
codesyscontrol_for_pfc100_sl*cpe:2.3:a:codesys:control_for_pfc100_sl:*:*:*:*:*:*:*:*
codesyscontrol_for_pfc200_sl*cpe:2.3:a:codesys:control_for_pfc200_sl:*:*:*:*:*:*:*:*
codesyscontrol_rte_sl*cpe:2.3:a:codesys:control_rte_sl:*:*:*:*:*:*:*:*
codesyscontrol_win_sl*cpe:2.3:a:codesys:control_win_sl:*:*:*:*:*:*:*:*
codesysdevelopment_system*cpe:2.3:a:codesys:development_system:*:*:*:*:*:*:*:*
codesyshmi_sl*cpe:2.3:a:codesys:hmi_sl:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
codesys	control_for_beaglebone_sl	*	cpe:2.3:a:codesys:control_for_beaglebone_sl::::::::
codesys	control_for_empc-a\/imx6_sl	*	cpe:2.3:a:codesys:control_for_empc-a\/imx6_sl::::::::
codesys	control_for_iot2000_sl	*	cpe:2.3:a:codesys:control_for_iot2000_sl::::::::
codesys	control_for_linux_sl	*	cpe:2.3:a:codesys:control_for_linux_sl::::::::
codesys	control_for_pfc100_sl	*	cpe:2.3:a:codesys:control_for_pfc100_sl::::::::
codesys	control_for_pfc200_sl	*	cpe:2.3:a:codesys:control_for_pfc200_sl::::::::
codesys	control_rte_sl	*	cpe:2.3:a:codesys:control_rte_sl::::::::
codesys	control_win_sl	*	cpe:2.3:a:codesys:control_win_sl::::::::
codesys	development_system	*	cpe:2.3:a:codesys:development_system::::::::
codesys	hmi_sl	*	cpe:2.3:a:codesys:hmi_sl::::::::