Vulnerabilities

TI-2020-09721 CVE-2020-12069 · GHSA-26j2-2wp8-h95h

CODESYS V3 prone to Inadequate Password Hashing

LOW 35

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00172 Published 2022-12-26 Fixed in V3.5.16.0 CWE-916

TI-2020-09719 CVE-2020-12067 · GHSA-xmxc-2jc7-w66m

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a…

MEDIUM 40

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00543 Published 2022-12-26 No fix listed CWE-640

TI-2019-06498 CVE-2019-9011 · GHSA-jj68-7h34-v267

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an…

LOW 31

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0048 Published 2022-12-26 No fix listed CWE-668

Vulnerabilities

Filters

CODESYS V3 prone to Inadequate Password Hashing

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a…

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an…