CVE-2019-9010 Missing authorization in n/a
Attackers can bypass ownership verification in the CODESYS Gateway communication channel, potentially gaining unauthorized access to industrial control systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-9010?
CVE-2019-9010 is a critical missing authorization vulnerability in Codesys Control for Beaglebone Sl, published on 15 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants of the following CODESYS V3 products in all versions prior to v3.5.14.20 that contain the CmpGateway component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control V3 Runtime System Toolkit, CODESYS Gateway V3, CODESYS V3 Development System.
Which versions are affected by CVE-2019-9010?
It affects 10 products.
Products include Codesys Control for Beaglebone Sl, Codesys Control for Empc-A\/Imx6 Sl, Codesys Control for Iot2000 Sl, Codesys Control for Linux Sl, Codesys Control for Pfc100 Sl, Codesys Control for Pfc200 Sl and 4 more.
How do I fix CVE-2019-9010?
No fix has been published for CVE-2019-9010 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-9010 being exploited?
There is no known exploitation of CVE-2019-9010 in the wild and no public exploit code.
Other vulnerabilities in Codesys Control for Beaglebone Sl
- CVE-2018-10612 Misconfiguration in 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0
- CVE-2023-6357 OS Command Injection in multiple CODESYS products
- CVE-2022-4046 CODESYS: Improper memory restrictions fro CODESYS Control
- CVE-2022-47379 CODESYS: Multiple products prone to out-of-bounds write
- CVE-2022-47380 CODESYS: Multiple products prone to out-of-bounds write
Sources
Also known as GHSA-ppm6-8p65-j9xg.