PT-2019-8756 · 3S Smart Software Solutions · Codesys Control V3

Publicado 2019-01-29 · Atualizado 2019-10-09 · CVE-2018-10612

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions GmbH CODESYS Control V3 versions prior to 3.5.14.0

Description The issue concerns the lack of default enablement for user access management and communication encryption. This could potentially allow an attacker to access the device and sensitive information, including user credentials.

Recommendations For versions prior to 3.5.14.0, update to version 3.5.14.0 or later to enable user access management and communication encryption by default.

Correção

Incorrect Permission

Improper Access Control

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-732

CWE-284

CWE-311

Identificadores relacionados

CVE-2018-10612

Produtos afetados

Codesys Control V3

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-10612 · Nota de Segurança
• http://securityfocus.com/bid/106248 · Nota
• https://osv.dev/vulnerability/CVE-2018-10612 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03 · Nota