CVE-2020-10609 : Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modif

Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system settings by someone with access to the device.

Published 2020-07-27 19:15:14

Updated 2020-07-30 18:37:39

Source ICS-CERT

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-10609

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 52 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-10609

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-10609

CWE-256 Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

Assigned by: ics-cert@hq.dhs.gov (Secondary)

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2020-10609

Grundfos » Cim 500 » Version: 06.16.00
cpe:2.3:a:grundfos:cim_500:06.16.00:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-10609

Exploit prediction scoring system (EPSS) score for CVE-2020-10609

CVSS scores for CVE-2020-10609

CWE ids for CVE-2020-10609

References for CVE-2020-10609

Products affected by CVE-2020-10609