National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

    Vulnerabilities Detail

CVE-2018-10612 Detail

Current Description

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.

Source:  MITRE
View Analysis Description

Severity

 


CVSS 3.x Severity and Metrics:

NIST CVSS score
NIST: NVD
Base Score: 9.8 CRITICAL
Vector:  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
http://www.securityfocus.com/bid/106248 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03 Third Party Advisory US Government Resource

Weakness Enumeration

CWE-ID CWE Name Source
CWE-311 Missing Encryption of Sensitive Data NIST  
CWE-732 Incorrect Permission Assignment for Critical Resource NIST  
CWE-284 Improper Access Control ICS-CERT  

Known Affected Software Configurations Switch to CPE 2.3

Configuration 1 ( hide )
 cpe:/a:codesys:control_for_beaglebone_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_for_empc-a%2fimx6_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_for_iot2000_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_for_linux_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_for_pfc100_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_for_pfc200_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_for_raspberry_pi_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_rte_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_runtime_toolkit
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:control_win_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:development_system_v3
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0
 cpe:/a:codesys:hmi_sl
     Show Matching CPE(s)
From (including)
3.0		Up to (excluding)
3.5.14.0


Change History

5 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2018-10612
NVD Published Date:
01/29/2019
NVD Last Modified:
10/09/2019