Description (CNA)
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CODESYS / CODESYS V3 containing the CmpUserMgr | affected V3 before V3.5.16.0 |
CWE
CWE-916
References
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=
- https://cert.vde.com/en/advisories/VDE-2021-061/
- https://cert.vde.com/en/advisories/VDE-2022-031/
- https://cert.vde.com/en/advisories/VDE-2022-022/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.