PT-2020-2068 · Yokogawa · Tristation 1131

Published 2020-04-14 · Updated 2021-11-08 · CVE-2020-7483

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions TriStation 1131 versions prior to v4.9.1

Description A vulnerability could cause certain data to be visible on the network when the password feature is enabled. This feature is an additional optional check performed by TS1131 to verify its connection to a specific controller. The data is sent as clear text and is visible on the network. The vulnerability allows a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to v4.9.1, consider disabling the password feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability, however versions v4.9.1 and later do not have this vulnerability.

Fix

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

BDU:2020-01902

CVE-2020-7483

Affected Products

Tristation 1131

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-7483 · Security Note
• https://bdu.fstec.ru/vul/2020-01902 · Security Note
• https://se.com/ww/en/download/document/SESB-2020-105-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7483 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01 · Note
• https://t.me/cvenotify/2852 · Telegram Post
• https://t.me/cvenotify/23157 · Telegram Post
• https://vuldb.com/?id.154023 · Note