An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unauthenticated access to the configuration and service interface.
Weakness
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pcoweb_card_web | Carel | 2.2 (including) | 2.2 (including) |
| Pcoweb_card_bios | Carel | 6.27 (including) | 6.27 (including) |
| Pcoweb_card_boot | Carel | 5.00 (including) | 5.00 (including) |
References
- https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18329.md
- https://medium.com/%40SergiuSechel/insecure-permissions-in-rehau-group-unlimited-polymer-solutions-implementation-of-carel-pcoweb-514c148ae694
- https://github.com/cybertoxin/CVEs/blob/main/CVE_2020_18329.md
- https://medium.com/%40SergiuSechel/insecure-permissions-in-rehau-group-unlimited-polymer-solutions-implementation-of-carel-pcoweb-514c148ae694