CVE-2012-3018

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-07-31 · updated 2026-06-16
Weakness: CWE-310

Description

The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.22 and earlier uses an improper encryption algorithm for generation of an authentication code, which allows local users to bypass intended access restrictions and obtain administrative access by predicting a challenge response.

Affected products

ICONICS Bizviz: through 9.22; 8.05, 9.0, 9.01, 9.1, 9.2, 9.13 (+2)
ICONICS GENESIS32: through 9.22; 8.05, 9.0, 9.1, 9.01, 9.2, 9.13 (+2)

References

http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf
http://www.us-cert.gov/control_systems/pdf/ICSA-12-212-01.pdf

Get alerted when CVE-2012-3018 or the next vulnerability affects your stack