Local Access Vulnerability in Pilz PNOZmulti Configurator Software for PMI m107 diag HMI Device
CVE-2018-19009

7.8HIGH

Key Information:

Vendor

Pilz

Status
Pilz Pnozmulti Configurator
Vendor
CVE Published:
25 January 2019

What is CVE-2018-19009?

The Pilz PNOZmulti Configurator software, prior to version 10.9, contains a local access vulnerability that permits authenticated attackers to view sensitive credential information in clear-text. This exposure specifically affects the PMI m107 diag HMI device. If an attacker gains local access to this data, they can manipulate the information on the HMI device, potentially leading to unauthorized modifications and security risks.

Affected Version(s)

Pilz PNOZmulti Configurator All versions prior to version 10.9

References

https://ics-cert.us-cert.gov/advisories/ICSA-19-010-03
x_refsource_MISC
http://www.securityfocus.com/bid/106529
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.