CVE-2019-9013 - CVE House
Back to Database
Status published High CVE-2019-9013

An issue was discovered in 3S-Smart CODESYS V3 products. The...

Vulnerability Description

An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insufficiently protected during transport. All variants of the following CODESYS V3 products in all versions containing the CmpUserMgr component are affected regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS V3 Simulation Runtime (part of the CODESYS Development System), CODESYS Control V3 Runtime System Toolkit, CODESYS HMI V3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9013

Credits & Attribution

No credits recorded in the NVD database.

References

More from codesys

View All →
CVE-2022-22510
CODESYS: Null Pointer Dereference in CODESYS PROFINET stack
High 7.5
CVE-2021-36765
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause...
High 7.5
CVE-2021-36764
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL...
High 7.5
CVE-2021-36763
In CODESYS V3 web server before 3.5.17.10, files or directories...
High 7.5
CVE-2021-33486
All versions of the CODESYS V3 Runtime Toolkit for VxWorks...
High 7.5

Affected Vendor

Affected Software

control for beaglebone sl, control for empc-a\/imx6 sl, control for iot2000 sl, control for linux sl, control for pfc100 sl, control for pfc200 sl, control rte sl, control win sl, development system, hmi sl, raspberry pi, runtime toolkit
Vulnerable Versions:
3.0

Timeline

Official Publish: August 15th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.