Hard-coded Encryption Key Vulnerability in WAGO e!Cockpit
CVE-2019-5106

5.5MEDIUM

Key Information:

Vendor
Wago
Status
Wago E!cockpit
Vendor
CVE Published:
11 March 2020

Summary

A vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1 due to the presence of a hard-coded encryption key. An attacker with access to the communications between e!Cockpit and CoDeSyS Gateway can easily retrieve user passwords during the login process, exposing sensitive information in plain text. This poses significant risks to the integrity and confidentiality of user accounts.

Affected Version(s)

WAGO e!Cockpit 1.5.1.1

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.