Vulnerability in Pilz Pnozmulti Configurator
CVE-2018-19009
Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti Configurator software to view sensitive credential data in clear-text. This sensitive data is applicable to only the PMI m107 diag HMI device. An attacker with access to this sensitive data and physical access to the PMI m107 diag can modify data on the HMI device.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (13.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 14th percentile — 13.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Pilz Pnozmulti Configurator — versions All versions prior to version 10.9
- Pilz Pnozmulti Configurator
Weakness classification (CWE)
References
- ics-cert.us-cert.gov/advisories/ICSA-19-010-03 (US Government Resource, Third Party Advisory)
- www.securityfocus.com/bid/106529 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-19009?
- CVE-2018-19009 is a high-severity vulnerability in Pilz Pnozmulti Configurator, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.8/10. Published 2019-01-25.
- How severe is CVE-2018-19009?
- High severity. CVSS v3 base score is 7.8 out of 10.