CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2020-12069
High (7.8). EPSS 0.2% chance of exploitation in the next 30 days.
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
- CWE
- CWE-916
- Published
- Modified
- Record from
- the NVD, synced
Affected
- codesys:control_for_beaglebone
- codesys:control_for_empc-a\/imx6
- codesys:control_for_iot2000
- codesys:control_for_linux
- codesys:control_for_pfc100
- codesys:control_for_pfc200
- codesys:control_for_plcnext
- codesys:control_for_raspberry_pi
- codesys:control_rte_v3
- codesys:control_v3_runtime_system_toolkit
- codesys:control_win_v3
- codesys:hmi_v3
- codesys:v3_simulation_runtime
- festo:controller_cecc-d_firmware
- festo:controller_cecc-lk_firmware
- festo:controller_cecc-s_firmware
- pilz:pmc
- wago:750-8100_firmware
- wago:750-8101_firmware
- wago:750-8102_firmware
- wago:750-8202_firmware
- wago:750-8203_firmware
- wago:750-8204_firmware
- wago:750-8206_firmware
- wago:750-8207_firmware
- wago:750-8210_firmware
- wago:750-8211_firmware
- wago:750-8212_firmware
- wago:750-8213_firmware
- wago:750-8214_firmware
- wago:750-8215_firmware
- wago:750-8216_firmware
- wago:750-8217_firmware
- wago:752-8303\/8000-0002_firmware
- wago:762-4201\/8000-001_firmware
- wago:762-4202\/8000-001_firmware
- wago:762-4203\/8000-001_firmware
- wago:762-4204\/8000-001_firmware
- wago:762-4205\/8000-001_firmware
- wago:762-4205\/8000-002_firmware
- wago:762-4206\/8000-001_firmware
- wago:762-4206\/8000-002_firmware
- wago:762-4301\/8000-002_firmware
- wago:762-4302\/8000-002_firmware
- wago:762-4303\/8000-002_firmware
- wago:762-4304\/8000-002_firmware
- wago:762-4305\/8000-002_firmware
- wago:762-4306\/8000-002_firmware
- wago:762-5203\/8000-001_firmware
- wago:762-5204\/8000-001_firmware
References
- https://cert.vde.com/en/advisories/VDE-2021-061/
- https://cert.vde.com/en/advisories/VDE-2022-022/
- https://cert.vde.com/en/advisories/VDE-2022-031/
- https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=
- https://cert.vde.com/en/advisories/VDE-2021-061/