#VU22293 Use of hard-coded credentials in pCOWeb and Chiller SK 3232-Series - CVE-2019-13553

Vulnerability identifier: #VU22293

Vulnerability risk: High

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-13553

CWE-ID: CWE-798

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
pCOWeb
Hardware solutions / Firmware
Chiller SK 3232-Series
Hardware solutions / Other hardware appliances

Vendor: Carel
Rittal

Description
The vulnerability allows a remote attacker to disrupt the primary operations.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials and influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

pCOWeb: B1.2.4 - A1.5.3

Chiller SK 3232-Series: All versions

---

External links
https://ics-cert.us-cert.gov/advisories/icsa-19-297-01

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.