CVE-2020-12069

Published: Dec 26, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Affected (67)

Products: Pilz: Pmc · Codesys: Control For Beaglebone, Control For Empc A/imx6, Control For Iot2000, Control For Linux, Control For Pfc100, Control For Pfc200, Control For Plcnext, Control For Raspberry Pi, Control Rte V3, Control V3 Runtime System Toolkit, Control Win V3, Hmi V3, V3 Simulation Runtime · Festo: Controller Cecc D Firmware, Controller Cecc Lk Firmware, Controller Cecc S Firmware · +1 more

Show all products

Pilz

1 product

Pmc

Codesys

13 products

Control For Beaglebone

Control For Empc A/imx6

Control For Raspberry Pi

Control Rte V3

Control V3 Runtime System Toolkit

Control Win V3

Hmi V3

V3 Simulation Runtime

Festo

3 products

Controller Cecc D Firmware

Controller Cecc Lk Firmware

Controller Cecc S Firmware

47 products

762 4201/8000 001 Firmware

762 4202/8000 001 Firmware

762 4203/8000 001 Firmware

762 4204/8000 001 Firmware

762 4205/8000 001 Firmware

762 4205/8000 002 Firmware

762 4206/8000 001 Firmware

762 4206/8000 002 Firmware

762 4301/8000 002 Firmware

762 4302/8000 002 Firmware

762 4303/8000 002 Firmware

762 4304/8000 002 Firmware

762 4305/8000 002 Firmware

762 4306/8000 002 Firmware

762 5203/8000 001 Firmware

762 5204/8000 001 Firmware

762 5205/8000 001 Firmware

762 5206/8000 001 Firmware

762 5303/8000 002 Firmware

762 5304/8000 002 Firmware

762 5305/8000 002 Firmware

762 5306/8000 002 Firmware

762 6201/8000 001 Firmware

762 6202/8000 001 Firmware

762 6203/8000 001 Firmware

762 6204/8000 001 Firmware

762 6301/8000 002 Firmware

762 6302/8000 002 Firmware

762 6303/8000 002 Firmware

762 6304/8000 002 Firmware

752 8303/8000 0002 Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pilz Pmc	From 3.0.0 to 3.5.17

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Codesys Control For Beaglebone	Before 3.5.16.0
Codesys Control For Empc A/imx6	Before 3.5.16.0
Codesys Control For Iot2000	Before 3.5.16.0
Codesys Control For Linux	Before 3.5.16.0
Codesys Control For Pfc100	Before 3.5.16.0
Codesys Control For Pfc200	Before 3.5.16.0
Codesys Control For Plcnext	Before 3.5.16.0
Codesys Control For Raspberry Pi	Before 3.5.16.0
Codesys Control Rte V3	Before 3.5.16.0
Codesys Control V3 Runtime System Toolkit	Before 3.5.16.0
Codesys Control Win V3	Before 3.5.16.0
Codesys Hmi V3	Before 3.5.16.0
Codesys V3 Simulation Runtime	Before 3.5.16.0

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Festo Controller Cecc D Firmware	Version 2.3.8.0
Festo Controller Cecc D Firmware	Version 2.3.8.1

Running on/with	Platform Versions
Festo Controller Cecc D	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Festo Controller Cecc Lk Firmware	Version 2.3.8.0
Festo Controller Cecc Lk Firmware	Version 2.3.8.1

Running on/with	Platform Versions
Festo Controller Cecc Lk	All versions

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Festo Controller Cecc S Firmware	Version 2.3.8.0
Festo Controller Cecc S Firmware	Version 2.3.8.1

Running on/with	Platform Versions
Festo Controller Cecc S	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8217 Firmware	All versions

Running on/with	Platform Versions
Wago 750 8217	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8216 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8216	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8215 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8215	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8214 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8214	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8213 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8213	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8212 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8212	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8211 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8211	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8210 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8210	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8207 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8207	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8206 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8206	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8204 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8204	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8203 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8203	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8202 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8202	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8102 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8102	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8101 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8101	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 750 8100 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 750 8100	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4201/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4201/8000 001	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4202/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4202/8000 001	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4203/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4203/8000 001	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4204/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4204/8000 001	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4205/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4205/8000 001	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4205/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4205/8000 002	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4206/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4206/8000 001	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4206/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4206/8000 002	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4301/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4301/8000 002	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4302/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4302/8000 002	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4303/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4303/8000 002	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4304/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4304/8000 002	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4305/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4305/8000 002	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 4306/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 4306/8000 002	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5203/8000 001 Firmware	Up to 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5203/8000 001	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5204/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5204/8000 001	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5205/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5205/8000 001	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5206/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5206/8000 001	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5303/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5303/8000 002	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5304/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5304/8000 002	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5305/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5305/8000 002	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 5306/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 5306/8000 002	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6201/8000 001 Firmware	Up to 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6201/8000 001	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6202/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6202/8000 001	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6203/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6203/8000 001	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6204/8000 001 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6204/8000 001	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6301/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6301/8000 002	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6302/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6302/8000 002	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6303/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6303/8000 002	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 762 6304/8000 002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 762 6304/8000 002	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Wago 752 8303/8000 0002 Firmware	Before 03.06.19\(18\)

Running on/with	Platform Versions
Wago 752 8303/8000 0002	All versions

Related CWEs

CWE-916

Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (8)

https://cert.vde.com/en/advisories/VDE-2021-061/

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2022-022/

Source: info@cert.vde.com

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2022-031/

Source: info@cert.vde.com

Third Party Advisory

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=

Source: info@cert.vde.com

Vendor Advisory

https://cert.vde.com/en/advisories/VDE-2021-061/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2022-022/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert.vde.com/en/advisories/VDE-2022-031/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12943&token=d097958a67ba382de688916f77e3013c0802fade&download=

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.