CVE-2020-12069 CODESYS V3 prone to Inadequate Password Hashing

What is CVE-2020-12069?

CVE-2020-12069 is a high-severity vulnerability in CODESYS V3 containing the CmpUserMgr, published on 26 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Weakness: CWE-916

Which versions are affected by CVE-2020-12069?

It affects 64 products.

Products include Codesys Control for Beaglebone, Codesys Control for Empc-A\/Imx6, Codesys Control for Iot2000, Codesys Control for Linux, Codesys Control for Pfc100, Codesys Control for Pfc200 and 58 more.

How do I fix CVE-2020-12069?

No fix has been published for CVE-2020-12069 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-12069 being exploited?

There is no known exploitation of CVE-2020-12069 in the wild and no public exploit code.

Other vulnerabilities in CODESYS V3 containing the CmpUserMgr

• CVE-2020-10245 Memory corruption in n/a Critical 9.8
• CVE-2019-18858 Memory corruption in n/a Critical 9.8
• CVE-2019-13548 Memory corruption in CODESYS V3 web server Critical 9.8
• CVE-2018-25048 Codesys Runtime Improper Limitation of a Pathname High 8.8
• CVE-2019-9008 Privilege escalation in n/a High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-26j2-2wp8-h95h.