CVE-2019-13553

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Oct 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-135548.8GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default crede CVE-2019-135555.9In Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04/06/13/26UDPVCPU: serial number 21081 and pr CVE-2019-135568.8In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the CVE-2019-135575.3In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow a remote attacker t CVE-2019-135589.8In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allo CVE-2019-135597.8GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited ap CVE-2019-13566.5An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory, aka 'Microsoft E CVE-2019-135609.8D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter CVE-2019-135619.8D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the online_f CVE-2019-135626.1D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr parameter, the /www/ping CVE-2019-135638.8D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.CVE-2019-135646.1XSS exists in Ping Identity Agentless Integration Kit before 1.5.