Information disclosure in Pilz PNOZmulti Configurator
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | N/A |
| CWE-ID | CWE-312 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software Subscribe |
PNOZmulti Configurator Client/Desktop applications / Other client software |
| Vendor | Pilz |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Information disclosure
EUVDB-ID: #VU16218
Risk: Low
CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: N/A
CWE-ID:
CWE-312 - Cleartext Storage of Sensitive Information
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to obtain potentially sensitive information on the target system.
The weakness exists due to cleartext storage of sensitive information in C:\ProgramData\Pilz\PNOZmulti Configurator v10.8.0\AppData\pmimicroconfig\UserSettings.xml. A local attacker with access to the PC file system that uses the software PNOZmulti
Configurator can read out sensitive data such as configuration data of an HMI device of type PMI m107 diag.
Update to version 10.9.
Vulnerable software versionsPNOZmulti Configurator: 10.0 - 10.8
External linksQ & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
