CVE-2020-12069

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

• Codesys Control For Beaglebone

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Empc A\/imx6

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Iot2000

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Linux

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Pfc100

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Pfc200

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Plcnext

  APP
  Codesys
  < 3.5.16.0

• Codesys Control For Raspberry Pi

  APP
  Codesys
  < 3.5.16.0

• Codesys Control Rte V3

  APP
  Codesys
  < 3.5.16.0

• Codesys Control V3 Runtime System Toolkit

  APP
  Codesys
  < 3.5.16.0

• Codesys Control Win V3

  APP
  Codesys
  < 3.5.16.0

• Codesys Hmi V3

  APP
  Codesys
  < 3.5.16.0

• Codesys V3 Simulation Runtime

  APP
  Codesys
  < 3.5.16.0

• Festo Controller Cecc D

  HW
  Festo
  all versions

• Festo Controller Cecc D Firmware

  OS
  Festo
  2.3.8.02.3.8.1

• Festo Controller Cecc Lk

  HW
  Festo
  all versions

• Festo Controller Cecc Lk Firmware

  OS
  Festo
  2.3.8.02.3.8.1

• Festo Controller Cecc S

  HW
  Festo
  all versions

• Festo Controller Cecc S Firmware

  OS
  Festo
  2.3.8.02.3.8.1

• Pilz Pmc

  APP
  Pilz
  3.0.0 – 3.5.17 (excl.)

• Wago 750 8100

  HW
  Wago
  all versions

• Wago 750 8100 Firmware

  OS
  Wago
  < 03.06.19\(18\)

• Wago 750 8101

  HW
  Wago
  all versions

• Wago 750 8101 Firmware

  OS
  Wago
  < 03.06.19\(18\)

• Wago 750 8102

  HW
  Wago
  all versions

• Wago 750 8102 Firmware

  OS
  Wago
  < 03.06.19\(18\)

• Wago 750 8202

  HW
  Wago
  all versions

• Wago 750 8202 Firmware

  OS
  Wago
  < 03.06.19\(18\)

• Wago 750 8203

  HW
  Wago
  all versions

• Wago 750 8203 Firmware

  OS
  Wago
  < 03.06.19\(18\)