Read the docs
TI-2020-08536 Aliases CVE-2020-10624GHSA-xh6g-hp9w-9662

Cleartext transmission of sensitive information in ControlEdge PLC

Priority LOW 34CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.

Why it matters now

EPSS 0.00743 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ControlEdge PLCR130.2; R140; R150; R151—No fix listedCNA
—ControlEdge RTUR101; R110; R140; R150; R151—No fix listedCNA
  • ControlEdge PLC Vendor— Affected R130.2; R140; R150; R151 Fixed in — No fix listed CNA
  • ControlEdge RTU Vendor— Affected R101; R110; R140; R150; R151 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:honeywell:controledge_plc_firmware:r130.2:*:*:*:*:*:*:*r130.2VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_plc_firmware:r140:*:*:*:*:*:*:*r140VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_plc_firmware:r150:*:*:*:*:*:*:*r150VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_plc_firmware:r151:*:*:*:*:*:*:*r151VulnerableHoneywell
cpe:2.3:h:honeywell:controledge_plc:-:*:*:*:*:*:*:*not specified by NVDRunning onHoneywell
cpe:2.3:o:honeywell:controledge_rtu_firmware:r101:*:*:*:*:*:*:*r101VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_rtu_firmware:r110:*:*:*:*:*:*:*r110VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_rtu_firmware:r140:*:*:*:*:*:*:*r140VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_rtu_firmware:r150:*:*:*:*:*:*:*r150VulnerableHoneywell
cpe:2.3:o:honeywell:controledge_rtu_firmware:r151:*:*:*:*:*:*:*r151VulnerableHoneywell
  • cpe:2.3:o:honeywell:controledge_plc_firmware:r130.2:*:*:*:*:*:*:* Versions r130.2 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_plc_firmware:r140:*:*:*:*:*:*:* Versions r140 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_plc_firmware:r150:*:*:*:*:*:*:* Versions r150 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_plc_firmware:r151:*:*:*:*:*:*:* Versions r151 Vulnerable ·Honeywell
  • cpe:2.3:h:honeywell:controledge_plc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell
  • cpe:2.3:o:honeywell:controledge_rtu_firmware:r101:*:*:*:*:*:*:* Versions r101 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_rtu_firmware:r110:*:*:*:*:*:*:* Versions r110 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_rtu_firmware:r140:*:*:*:*:*:*:* Versions r140 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_rtu_firmware:r150:*:*:*:*:*:*:* Versions r150 Vulnerable ·Honeywell
  • cpe:2.3:o:honeywell:controledge_rtu_firmware:r151:*:*:*:*:*:*:* Versions r151 Vulnerable ·Honeywell
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:honeywell:controledge_rtu:-:*:*:*:*:*:*:*not specified by NVDRunning onHoneywell
  • cpe:2.3:h:honeywell:controledge_rtu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Honeywell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10624
  2. 2026-10-03 Alias added: GHSA-xh6g-hp9w-9662

References

Advisory 1

  • TI-2022-12553 Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. CVSS 3.1CRITICAL 9.8
  • TI-2020-08540 Cleartext transmission of sensitive information in ControlEdge PLC CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences