CODESYS V3 prone to Inadequate Password Hashing
Priority LOW 35CWE-916Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-08
Fix Fixed CODESYS V3 containing the CmpUserMgr (CODESYS): V3.5.16.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CODESYS | CODESYS V3 containing the CmpUserMgr | V3 to before V3.5.16.0 | V3.5.16.0 | Patch available | CNA |
- CODESYS V3 containing the CmpUserMgr VendorCODESYS Affected V3 to before V3.5.16.0 Fixed in V3.5.16.0 Patch available CNA
CPE configurations NVD · 117
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pilz:pmc:*:*:*:*:*:*:*:* | 3.0.0 to before 3.5.17 | Vulnerable | Pilz |
| cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_linux:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_plcnext:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_rte_v3:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
- cpe:2.3:a:pilz:pmc:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.5.17 Vulnerable ·Pilz
- cpe:2.3:a:codesys:control_for_beaglebone:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_empc-a\/imx6:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_iot2000:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_linux:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_pfc100:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_pfc200:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_plcnext:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_for_raspberry_pi:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_rte_v3:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
Show 107 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:codesys:control_v3_runtime_system_toolkit:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:control_win_v3:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:hmi_v3:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:a:codesys:v3_simulation_runtime:*:*:*:*:*:*:*:* | before 3.5.16.0 | Vulnerable | CODESYS |
| cpe:2.3:o:festo:controller_cecc-d_firmware:2.3.8.0:*:*:*:*:*:*:* | 2.3.8.0 | Vulnerable | Festo |
| cpe:2.3:o:festo:controller_cecc-d_firmware:2.3.8.1:*:*:*:*:*:*:* | 2.3.8.1 | Vulnerable | Festo |
| cpe:2.3:h:festo:controller_cecc-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Festo |
| cpe:2.3:o:festo:controller_cecc-lk_firmware:2.3.8.0:*:*:*:*:*:*:* | 2.3.8.0 | Vulnerable | Festo |
| cpe:2.3:o:festo:controller_cecc-lk_firmware:2.3.8.1:*:*:*:*:*:*:* | 2.3.8.1 | Vulnerable | Festo |
| cpe:2.3:h:festo:controller_cecc-lk:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Festo |
| cpe:2.3:o:festo:controller_cecc-s_firmware:2.3.8.0:*:*:*:*:*:*:* | 2.3.8.0 | Vulnerable | Festo |
| cpe:2.3:o:festo:controller_cecc-s_firmware:2.3.8.1:*:*:*:*:*:*:* | 2.3.8.1 | Vulnerable | Festo |
| cpe:2.3:h:festo:controller_cecc-s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Festo |
| cpe:2.3:o:wago:750-8217_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8217:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8216_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8216:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8215_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8215:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8214_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8214:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8213_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8213:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8212_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8212:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8211_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8211:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8210_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8210:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8207_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8207:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8206_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8206:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8204_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8204:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8203_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8203:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8202_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8202:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8102_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8102:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8101_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8101:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:750-8100_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:750-8100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4201\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4201\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4202\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4202\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4203\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4203\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4204\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4204\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4205\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4205\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4205\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4205\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4206\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4206\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4206\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4206\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4301\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4301\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4302\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4302\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4303\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4303\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4304\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4304\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4305\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4305\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-4306\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-4306\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5203\/8000-001_firmware:*:*:*:*:*:*:*:* | up to 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5203\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5204\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5204\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5205\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5205\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5206\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5206\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5303\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5303\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5304\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5304\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5305\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5305\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-5306\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-5306\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6201\/8000-001_firmware:*:*:*:*:*:*:*:* | up to 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6201\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6202\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6202\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6203\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6203\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6204\/8000-001_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6204\/8000-001:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6301\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6301\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6302\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6302\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6303\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6303\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:762-6304\/8000-002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:762-6304\/8000-002:-:*:*:*:*:*:*:* | not specified by NVD | Running on | WAGO |
| cpe:2.3:o:wago:752-8303\/8000-0002_firmware:*:*:*:*:*:*:*:* | before 03.06.19\(18\) | Vulnerable | WAGO |
| cpe:2.3:h:wago:752-8303\/8000-0002:*:*:*:*:*:*:*:* | all versions | Running on | WAGO |
- cpe:2.3:a:codesys:control_v3_runtime_system_toolkit:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:control_win_v3:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:hmi_v3:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:a:codesys:v3_simulation_runtime:*:*:*:*:*:*:*:* Versions before 3.5.16.0 Vulnerable ·CODESYS
- cpe:2.3:o:festo:controller_cecc-d_firmware:2.3.8.0:*:*:*:*:*:*:* Versions 2.3.8.0 Vulnerable ·Festo
- cpe:2.3:o:festo:controller_cecc-d_firmware:2.3.8.1:*:*:*:*:*:*:* Versions 2.3.8.1 Vulnerable ·Festo
- cpe:2.3:h:festo:controller_cecc-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Festo
- cpe:2.3:o:festo:controller_cecc-lk_firmware:2.3.8.0:*:*:*:*:*:*:* Versions 2.3.8.0 Vulnerable ·Festo
- cpe:2.3:o:festo:controller_cecc-lk_firmware:2.3.8.1:*:*:*:*:*:*:* Versions 2.3.8.1 Vulnerable ·Festo
- cpe:2.3:h:festo:controller_cecc-lk:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Festo
- cpe:2.3:o:festo:controller_cecc-s_firmware:2.3.8.0:*:*:*:*:*:*:* Versions 2.3.8.0 Vulnerable ·Festo
- cpe:2.3:o:festo:controller_cecc-s_firmware:2.3.8.1:*:*:*:*:*:*:* Versions 2.3.8.1 Vulnerable ·Festo
- cpe:2.3:h:festo:controller_cecc-s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Festo
- cpe:2.3:o:wago:750-8217_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8217:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8216_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8216:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8215_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8215:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8214_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8214:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8213_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8213:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8212_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8211_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8211:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8210_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8207_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8207:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8206_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8206:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8204_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8204:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8203_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8203:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8202_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8202:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8102_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8102:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8101_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8101:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:750-8100_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:750-8100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4201\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4201\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4202\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4202\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4203\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4203\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4204\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4204\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4205\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4205\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4205\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4205\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4206\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4206\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4206\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4206\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4301\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4301\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4302\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4302\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4303\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4303\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4304\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4304\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4305\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4305\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-4306\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-4306\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5203\/8000-001_firmware:*:*:*:*:*:*:*:* Versions up to 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5203\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5204\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5204\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5205\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5205\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5206\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5206\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5303\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5303\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5304\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5304\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5305\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5305\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-5306\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-5306\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6201\/8000-001_firmware:*:*:*:*:*:*:*:* Versions up to 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6201\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6202\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6202\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6203\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6203\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6204\/8000-001_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6204\/8000-001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6301\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6301\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6302\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6302\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6303\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6303\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:762-6304\/8000-002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:762-6304\/8000-002:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·WAGO
- cpe:2.3:o:wago:752-8303\/8000-0002_firmware:*:*:*:*:*:*:*:* Versions before 03.06.19\(18\) Vulnerable ·WAGO
- cpe:2.3:h:wago:752-8303\/8000-0002:*:*:*:*:*:*:*:* Versions all versions Running on ·WAGO
Remediation
- Fix · CNA CODESYS V3 containing the CmpUserMgr (CODESYS) Fixed in V3.5.16.0
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12069
- 2026-10-03 Alias added: GHSA-26j2-2wp8-h95h
References
More CODESYS Control For Beaglebone vulnerabilities
- TI-2019-10180 Stack-based buffer overflow in CODESYS V3 web server CVSS 3.1CRITICAL 9.8
- TI-2020-08257 CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. CVSS 3.1CRITICAL 9.8
- TI-2019-13592 CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. CVSS 3.1CRITICAL 9.8
- TI-2019-06495 An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. CVSS 3.1HIGH 8.8
- TI-2018-15275 Codesys Runtime Improper Limitation of a Pathname CVSS 3.1HIGH 8.8
- TI-2019-10164 Path traversal in CODESYS V3 web server CVSS 3.1HIGH 7.5
Sources
- CVE-2020-12069 · CVE Program
- CVE-2020-12069 · NVD
- FIRST EPSS
- GHSA-26j2-2wp8-h95h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences