Lucene search

[email protected]CVE-2018-20025

HistoryFeb 19, 2019 - 9:29 p.m.

CVE-2018-20025

2019-02-1921:29:00

CWE-330

[email protected]

web.nvd.nist.gov

cve-2018-20025

insufficiently random values

codesys v3

nvd

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.5%

JSON

Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0.

Affected configurations

NVD

Node

codesyscontrol_for_beaglebone_slRange3.0–3.5.14.0

codesyscontrol_for_empc-a\/imx6_slRange3.0–3.5.14.0

codesyscontrol_for_iot2000_slRange3.0–3.5.14.0

codesyscontrol_for_linux_slRange3.0–3.5.14.0

codesyscontrol_for_pfc100_slRange3.0–3.5.14.0

codesyscontrol_for_pfc200_slRange3.0–3.5.14.0

codesyscontrol_for_raspberry_pi_slRange3.0–3.5.14.0

codesyscontrol_rte_slRange3.0–3.5.14.0

codesyscontrol_rte_sl_\(for_beckhoff_cx\)Range3.0–3.5.14.0

codesyscontrol_runtime_toolkitRange3.0–3.5.14.0

codesyscontrol_win_slRange3.0–3.5.14.0

codesysdevelopment_systemRange3.0–3.5.14.0

codesysgatewayRange3.0–3.5.14.0

codesyshmi_slRange3.0–3.5.14.0

codesyssafety_sil2Range3.0–3.5.14.0

CPENameOperatorVersion
codesys:control_for_beaglebone_slcodesys control for beaglebone sllt3.5.14.0
codesys:control_for_empc-a\/imx6_slcodesys control for empc-a/imx6 sllt3.5.14.0
codesys:control_for_iot2000_slcodesys control for iot2000 sllt3.5.14.0
codesys:control_for_linux_slcodesys control for linux sllt3.5.14.0
codesys:control_for_pfc100_slcodesys control for pfc100 sllt3.5.14.0
codesys:control_for_pfc200_slcodesys control for pfc200 sllt3.5.14.0
codesys:control_for_raspberry_pi_slcodesys control for raspberry pi sllt3.5.14.0
codesys:control_rte_slcodesys control rte sllt3.5.14.0
codesys:control_rte_sl_\(for_beckhoff_cx\)codesys control rte sl (for beckhoff cx)lt3.5.14.0
codesys:control_runtime_toolkitcodesys control runtime toolkitlt3.5.14.0

CPE	Name	Operator	Version
codesys:control_for_beaglebone_sl	codesys control for beaglebone sl	lt	3.5.14.0
codesys:control_for_empc-a\/imx6_sl	codesys control for empc-a/imx6 sl	lt	3.5.14.0
codesys:control_for_iot2000_sl	codesys control for iot2000 sl	lt	3.5.14.0
codesys:control_for_linux_sl	codesys control for linux sl	lt	3.5.14.0
codesys:control_for_pfc100_sl	codesys control for pfc100 sl	lt	3.5.14.0
codesys:control_for_pfc200_sl	codesys control for pfc200 sl	lt	3.5.14.0
codesys:control_for_raspberry_pi_sl	codesys control for raspberry pi sl	lt	3.5.14.0
codesys:control_rte_sl	codesys control rte sl	lt	3.5.14.0
codesys:control_rte_sl_\(for_beckhoff_cx\)	codesys control rte sl (for beckhoff cx)	lt	3.5.14.0
codesys:control_runtime_toolkit	codesys control runtime toolkit	lt	3.5.14.0

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "product": "CODESYS V3 products",
    "vendor": "Kaspersky Lab",
    "versions": [
      {
        "status": "affected",
        "version": "prior V3.5.14.0"
      }
    ]
  }
]

References

www.securityfocus.com/bid/106251

ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-037-codesys-control-v3-use-of-insufficiently-random-values/

ics-cert.us-cert.gov/advisories/ICSA-18-352-04

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

71.5%

JSON

Related for CVE-2018-20025

prion1 nvd1 cvelist1 ics1