CVE-2019-13549

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on and off and setting the temperature set point, can be modified without authentication.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://seclists.org/fulldisclosure/2019/Oct/46
https://www.us-cert.gov/ics/advisories/icsa-19-297-01	Third Party Advisory US Government Resource
http://seclists.org/fulldisclosure/2019/Oct/46
https://www.us-cert.gov/ics/advisories/icsa-19-297-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:carel:pcoweb_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:rittal:chiller_sk_3232:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-10-25 18:15

Updated : 2024-11-21 04:25

NVD link : CVE-2019-13549

Mitre link : CVE-2019-13549

CVE.ORG link : CVE-2019-13549

JSON object : View

Products Affected

carel

pcoweb_firmware

rittal

chiller_sk_3232

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2019-13549", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-10-25T18:15:10.880", "references": [{"url": "http://seclists.org/fulldisclosure/2019/Oct/46", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-19-297-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "http://seclists.org/fulldisclosure/2019/Oct/46", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-19-297-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 \u2013 B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on and off and setting the temperature set point, can be modified without authentication."}, {"lang": "es", "value": "El Interfaz web Rittal Chiller SK 3232-Series seg\u00fan el firmware Carel pCOWeb A1.5.3 - B1.2.4. El mecanismo de autenticaci\u00f3n en los sistemas afectados no proporciona un nivel suficiente de protecci\u00f3n contra cambios de configuraci\u00f3n no autorizados. Las operaciones primarias, a saber, encender y apagar la unidad de enfriamiento y establecer el punto de ajuste de temperatura, se pueden modificar sin autenticaci\u00f3n."}], "lastModified": "2024-11-21T04:25:07.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:carel:pcoweb_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B7B4C31-67E0-488A-9297-B8E8E158DC3E", "versionEndIncluding": "b1.2.4", "versionStartIncluding": "a1.5.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:rittal:chiller_sk_3232:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3FAC3FD5-429B-48BF-B519-47CAD3E718C0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}