title: A bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.
description: A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to components part of the applied security policy.
problem types: CWE-276 Incorrect Default Permissions
affected:
{
product: CODESYS Control for BeagleBone SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for Beckhoff CX9020 SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for emPC-A/iMX6 SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for IOT2000 SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for Linux SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for PFC100 SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for PFC200 SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for Raspberry Pi SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control for WAGO Touch Panels 600 SL
vendor: CODESYS
versions:
lessThan: V4.5.0.0, status: affected, version: V4.5.0.0, versionType: custom
}
{
product: CODESYS Control Runtime System Toolkit
vendor: CODESYS
versions:
lessThan: V3.5.18.0, status: affected, version: V3.5.18.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]