cve/2019/CVE-2019-13549.md

### [CVE-2019-13549](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13549)
![](https://img.shields.io/static/v1?label=Product&message=Rittal%20Chiller%20SK%203232-Series&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=MISSING%20AUTHENTICATION%20FOR%20CRITICAL%20FUNCTION%20CWE-306&color=brighgreen)

### Description

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on and off and setting the temperature set point, can be modified without authentication.

### POC

#### Reference
- http://seclists.org/fulldisclosure/2019/Oct/46
- http://seclists.org/fulldisclosure/2019/Oct/46

#### Github
No PoCs found on GitHub currently.