CVE-2020-10624 Information disclosure in ControlEdge PLC

High 7.5 Published 26 Jun 2020 Updated 4 Aug 2024

Attackers can intercept session tokens transmitted over the network, potentially leading to unauthorized access to ControlEdge PLC and RTU devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-10624?

CVE-2020-10624 is a high-severity vulnerability in ControlEdge PLC, published on 26 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.

Weakness: CWE-319

Which versions are affected by CVE-2020-10624?

It affects 2 products.

Products include Honeywell Controledge Plc Firmware, Honeywell Controledge Rtu Firmware.

How do I fix CVE-2020-10624?

No fix has been published for CVE-2020-10624 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-10624 being exploited?

There is no known exploitation of CVE-2020-10624 in the wild and no public exploit code.

Sources

Also known as GHSA-xh6g-hp9w-9662.