Read the docs
TI-2018-13473 Aliases CVE-2018-19009GHSA-7f64-hfxq-83h4

Cleartext storage of sensitive information in Pilz PNOZmulti Configurator

Priority LOW 34CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312.

Summary

Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker with access to this sensitive data and physical access to the PMI m107 diag can modify data on the HMI device.

Why it matters now

EPSS 0.00241 15th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PilzPilz PNOZmulti ConfiguratorAll versions prior to version 10.9—No fix listedCNA
  • Pilz PNOZmulti Configurator VendorPilz Affected All versions prior to version 10.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pilz:pnozmulti_configurator:*:*:*:*:*:*:*:*before 10.9.0VulnerablePilz
  • cpe:2.3:a:pilz:pnozmulti_configurator:*:*:*:*:*:*:*:* Versions before 10.9.0 Vulnerable ·Pilz

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-19009
  2. 2026-10-03 Alias added: GHSA-7f64-hfxq-83h4

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences