CVE-2018-19009 - CVE House
Back to Database
Status published High CVE-2018-19009

Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated...

Vulnerability Description

Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker with access to this sensitive data and physical access to the PMI m107 diag can modify data on the HMI device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19009

Credits & Attribution

No credits recorded in the NVD database.

References

More from Pilz

View All →
CVE-2025-41656
Pilz: Missing Authentication in Node-RED integration
Critical 10
CVE-2025-41648
Pilz: Authentication Bypass in IndustrialPI Webstatus
Critical 9.8
CVE-2023-45796
XSS vulnerability in Pilz PASvisu and PMI v8xx
High 8.1
CVE-2023-45795
Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx
High 7.8

Affected Vendor

Affected Software

Pilz PNOZmulti Configurator
Vulnerable Versions:
All versions prior to version 10.9

Timeline

Official Publish: January 25th, 2019
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-312

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1530 Data from Cloud Storage
Collection
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration