Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2020-12069: In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime

34
Routine
HIGH 7.8WATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2020-12069 is a high-severity flaw (CVSS 7.8) affecting pmc, control for beaglebone, control for empc-a\/imx6. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low privileges to gain full control of the device.

Why this priority

  • High severity
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score7.8 (High)
Attack vectorLocal
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.2% (top 93%)
CISA exploited listNo
WeaknessCWE-916
Published2022-12-26
Last modified2026-06-17
Publisher (CNA): CERT VDE · Vendor: codesys · pilz

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

pilz pmc UPGRADE
Affected: >= 3.0.0 and < 3.5.17
Fixed in: 3.5.17
Safe to downgrade to: a release before 3.0.0
1. Check installed version
apt-cache policy pmc || rpm -q pmc || pmc --version
2. UPGRADE to 3.5.17 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade pmc
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade pmc
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.0.0 (Debian / Ubuntu)
apt-cache madison pmc sudo apt install pmc=<VERSION_BEFORE_3.0.0> sudo apt-mark hold pmc
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list pmc sudo dnf downgrade pmc-<VERSION_BEFORE_3.0.0> sudo dnf versionlock add pmc
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
codesys control for beaglebone UPGRADE
Affected: < 3.5.16.0
Fixed in: 3.5.16.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy control-for-beaglebone || rpm -q control-for-beaglebone || control-for-beaglebone --version
2. UPGRADE to 3.5.16.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade control-for-beaglebone
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade control-for-beaglebone
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codesys control for empc-a\/imx6 UPGRADE
Affected: < 3.5.16.0
Fixed in: 3.5.16.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy control-for-empc-aimx6 || rpm -q control-for-empc-aimx6 || control-for-empc-aimx6 --version
2. UPGRADE to 3.5.16.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade control-for-empc-aimx6
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade control-for-empc-aimx6
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codesys control for iot2000 UPGRADE
Affected: < 3.5.16.0
Fixed in: 3.5.16.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy control-for-iot2000 || rpm -q control-for-iot2000 || control-for-iot2000 --version
2. UPGRADE to 3.5.16.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade control-for-iot2000
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade control-for-iot2000
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codesys control for linux UPGRADE
Affected: < 3.5.16.0
Fixed in: 3.5.16.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy control-for-linux || rpm -q control-for-linux || control-for-linux --version
2. UPGRADE to 3.5.16.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade control-for-linux
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade control-for-linux
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
codesys control for pfc100 UPGRADE
Affected: < 3.5.16.0
Fixed in: 3.5.16.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy control-for-pfc100 || rpm -q control-for-pfc100 || control-for-pfc100 --version
2. UPGRADE to 3.5.16.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade control-for-pfc100
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade control-for-pfc100
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-12069?

pmc: upgrade to 3.5.17; control for beaglebone: upgrade to 3.5.16.0; control for empc-a\/imx6: upgrade to 3.5.16.0. Exact commands for each OS are on this page.

Is CVE-2020-12069 being exploited?

CVE-2020-12069 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-12069 affect?

CVE-2020-12069 affects pmc, control for beaglebone, control for empc-a\/imx6. Severity is high (CVSS 7.8). In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system stores the online communication passwords using a weak hashing algorithm. This can be used by a local attacker with low pri

How urgent is CVE-2020-12069?

Priority 34/100. High severity; On your watchlist

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.