CVE-2020-12069CWE-916

CODESYS V3 prone to Inadequate Password Hashing

High · published December 26, 2022

CVSS v3.1
7.8
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00172 · 6.2th percentile
Weakness
CWE-916 · Use of Password Hash With Insufficient Computational Effort
Published
2022-12-26T00:00Z
EPSS history
Timeline
  • 26 DEC 00:00Z
    CODESYS V3 prone to Inadequate Password Hashing
    cvelistv5