In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	Name	Product	Family	Type	Severity
502485	Wago CODESYS V3 Products Use of Password Hash With Insufficient Computational Effort (CVE-2020-12069)	Tenable OT Security	Tenable.ot	Remote	high
502484	Festo CODESYS V3 Products Use of Password Hash With Insufficient Computational Effort (CVE-2020-12069)	Tenable OT Security	Tenable.ot	Remote	high

Detections

Analytics

CVE-2020-12069

high

Tenable Plugins

high

high