#VU22293 Use of hard-coded credentials


Published: 2019-10-25

Vulnerability identifier: #VU22293

Vulnerability risk: High

CVSSv3.1:

CVE-ID: CVE-2019-13553

CWE-ID: CWE-798

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
pCOWeb
Hardware solutions / Firmware
Chiller SK 3232-Series
Hardware solutions / Other hardware appliances

Vendor: Carel
Rittal

Description
The vulnerability allows a remote attacker to disrupt the primary operations.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials and influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.


Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

pCOWeb: A1.5.3 - B1.2.4

Chiller SK 3232-Series: All versions


CPE

External links
http://ics-cert.us-cert.gov/advisories/icsa-19-297-01


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability