CVE-2019-13553 Hardcoded credentials in Rittal Chiller SK 3232-Series
Hard-coded credentials in the Rittal Chiller web interface allow attackers to control cooling operations and modify temperature settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13553?
CVE-2019-13553 is a critical vulnerability in Rittal Chiller SK 3232-Series, published on 25 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.
Weakness: CWE-798
Which versions are affected by CVE-2019-13553?
It affects 1 product.
Products include Carel Pcoweb Firmware.
How do I fix CVE-2019-13553?
No fix has been published for CVE-2019-13553 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13553 being exploited?
There is no known exploitation of CVE-2019-13553 in the wild and no public exploit code.
Other vulnerabilities in Rittal Chiller SK 3232-Series
Sources
Also known as GHSA-6j53-rvq8-q9pr.