PT-2019-13412 · Rittal · Rittal Chiller Sk 3232-Series

Published 2019-10-25 · Updated 2020-02-10 · CVE-2019-13549

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rittal Chiller SK 3232-Series versions A1.5.3 through B1.2.4

Description The issue concerns the authentication mechanism in the web interface of the affected systems, which does not provide sufficient protection against unauthorized configuration changes. This allows primary operations, such as turning the cooling unit on and off and setting the temperature set point, to be modified without authentication.

Recommendations For versions A1.5.3 through B1.2.4, consider restricting access to the web interface until a fix is available, and ensure that physical access to the device is controlled to prevent unauthorized changes. As a temporary workaround, limit the use of the web interface for configuration changes and rely on alternative, more secure methods for managing the device.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-13549

Affected Products

Rittal Chiller Sk 3232-Series

References · 4

• https://osv.dev/vulnerability/CVE-2019-13549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13549 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-297-01 · Note
• http://seclists.org/fulldisclosure/2019/Oct/46 · Note