QID 590500

Date Published: 2021-08-03

QID 590500: PACTware Multiple Vulnerabilities(PWC-VD-2020-01)

The software product PACTware is a manufacturer and Fieldbus independent operating software for all field devices and protocols.PACTware supports 'user roles', which limit user access according to FDT Guidelines. By default, no passwords are set and the default user has the user role admin with no limitations.
Affected products
PACTware 5.0.4.xx and lower
PACTware 4.1 SP5 and lower
PACTware 3.X and lower
PACTware 2.4 and lower

QID Detection Logic (Authenticated)
QID checks for the Vulnerable version using windows registry keys

If the user has not enabled individual roles, an attacker may enable the roles and assign passwords to them. This could block legitimate users from using the software.

CVSS V3 rated as High - 7.1 severity.

CVSS V2 rated as Medium - 3.6 severity.

Solution

Customers are advised to refer to CERT MITIGATIONS section PWC-VD-2020-01 for affected packages and patching details.

Vendor References

PWC-VD-2020-01 - pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf

CVEs related to QID 590500

CVE-2020-9403 | CVE-2020-9404 |

Software Advisories

Advisory ID	Software	Component	Link
PWC-VD-2020-01			pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].