CVE-2019-13553

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-25 · updated 2026-06-17
Weakness: CWE-798

Description

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.

Affected products

Carel Pcoweb Firmware: from a1.5.3 through b1.2.4

References

http://seclists.org/fulldisclosure/2019/Oct/45
https://www.us-cert.gov/ics/advisories/icsa-19-297-01
http://seclists.org/fulldisclosure/2019/Oct/45
https://www.us-cert.gov/ics/advisories/icsa-19-297-01

Get alerted when CVE-2019-13553 or the next vulnerability affects your stack