CVE-2020-12069: Codesys Control For Beaglebone

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Affected products

  • Codesys Control For Beaglebone: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For Empc-a/imx6: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For IOT2000: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For Linux: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For PFC100: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For PFC200: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For Plcnext: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control For Raspberry Pi: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control Rte v3: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control v3 Runtime System Toolkit: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys Control Win v3: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys HMI v3: before 3.5.16.0 (fixed in 3.5.16.0)
  • Codesys v3 Simulation Runtime: before 3.5.16.0 (fixed in 3.5.16.0)
  • Festo Controller Cecc-D Firmware: version 2.3.8.0 only; version 2.3.8.1 only
  • Festo Controller Cecc-Lk Firmware: version 2.3.8.0 only; version 2.3.8.1 only
  • Festo Controller Cecc-S Firmware: version 2.3.8.0 only; version 2.3.8.1 only
  • Pilz Pmc: from 3.0.0, before 3.5.17 (fixed in 3.5.17)
  • Wago 750-8100 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8101 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8102 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8202 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8203 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8204 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8206 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • Wago 750-8207 Firmware: before 03.06.19\(18\) (fixed in 03.06.19\(18\))
  • and 39 more

Published 2022-12-26. Last modified 2026-06-17.