// For flags

CVE-2019-5106

 

Severity Score

5.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text.

existe una vulnerabilidad de clave de cifrado embebida en la funcionalidad de autenticación de WAGO e!Cockpit versión 1.5.1.1. Un atacante con acceso a las comunicaciones entre e!Cockpit y CoDeSyS Gateway puede recuperar trivialmente la contraseña de cualquier usuario al intentar iniciar sesión, en texto plano.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-04 CVE Reserved
  • 2020-03-10 CVE Published
  • 2023-07-14 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-798: Use of Hard-coded Credentials
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0898 2024-08-04
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Wago
Search vendor "Wago"
 E\!cockpit
Search vendor "Wago" for product "E\!cockpit"
 1.5.1.1
Search vendor "Wago" for product "E\!cockpit" and version "1.5.1.1"
-
Affected