CVE-2019-5106 - A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1

Back Back to CVE browser

MEDIUM

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1

Published Mar 10, 2020

5.5

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text.

Affected products

Vendor Wago Product WAGO e!Cockpit Default
n/a
- Version
  1.5.1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wago

WAGO e!Cockpit

n/a

Version	Status	Constraints
1.5.1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14711
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0898
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14711		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0898		x_refsource_MISCExploitThird Party Advisory