CVE-2018-10612
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD
Description
In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials.
Affected (12)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 | |
| From 3.0 to 3.5.14.0 |
Related CWEs
CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-311
Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
References (4)
Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Timeline
No history available yet.