PT-2020-12237 · Grundfos · Grundfos Cim 500

Published 2020-07-27 · Updated 2020-07-30 · CVE-2020-10609

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grundfos CIM 500 version 06.16.00

Description The issue concerns the storage of plaintext credentials in the device, which could allow unauthorized access to sensitive information or modification of system settings by someone with access to the device.

Recommendations For Grundfos CIM 500 version 06.16.00, consider restricting access to the device to minimize the risk of exploitation, and avoid using the device until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2020-10609

Affected Products

Grundfos Cim 500

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10609 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10609 · Vendor Advisory
• https://t.me/cibsecurity/13681 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-189-01 · Note