PT-2019-12262 · Carel · Pcoweb

Published 2019-06-03 · Updated 2020-08-24 · CVE-2019-11369

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Carel pCOWeb versions prior to B1.2.4

Description An issue in Carel pCOWeb allows the device to store cleartext passwords in the /config/pw changeusers.html file, potentially enabling someone with access to the device to read sensitive information.

Recommendations For versions prior to B1.2.4, update to version B1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the /config/pw changeusers.html file to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2019-11369

Affected Products

Pcoweb

References · 6

• 🔥 https://github.com/nepenthe0320/cve_poc/blob/master/CVE-2019-11369 · Exploit
• 🔥 https://drive.google.com/open?id=12Sq6oaxe1mC1y71Emo1YladjDjwTdNfb · Exploit
• 🔥 https://exploit-db.com/exploits/46898 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11369 · Security Note
• http://seclists.org/fulldisclosure/2019/Oct/45 · Note