CVE-2020-12493 is a missing-access-control flaw (CWE-284) in SWARCO's CPU LS4000 Series traffic signal controller: an open network port left over for debugging grants full root access to the device without any authentication, allowing a remote, unauthenticated attacker to take over the controller and disturb the traffic signal equipment it operates. Both NVD and the German VDE CERT that issued the advisory rate it 10.0 (critical) on CVSS v3.1.
Vulnerability summary
10
Critical
1.4%
EPSS score (FIRST)
No
CISA KEV catalog
2020-05-29
Published
Vulnerability ID: CVE-2020-12493 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| SWARCO CPU LS4000 Series traffic signal controller | cpe:2.3:o:swarco:cpu_ls4000_firmware:g4:*:*:*:*:*:*:* | CPU LS4000 Series running firmware versions starting with "G4...", per VDE CERT advisory VDE-2020-016 |
What does this mean for affected devices?
CVE-2020-12493 (CWE-284, improper access control) affects the SWARCO CPU LS4000 Series, described by VDE CERT as "a traffic control device used in signal management systems" manufactured by SWARCO TRAFFIC SYSTEMS GmbH (VDE CERT VDE-2020-016) — i.e. a roadway traffic signal controller.
NVD's description states: "An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices" (NVD).
NVD records a Primary CVSS v3.1 score of 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, a changed scope (the debug port breaks out of the controller's own security boundary), and complete loss of confidentiality, integrity and availability; VDE CERT, the reporting CERT, recorded an identical Secondary score and vector, and NVD additionally records a CVSS v2.0 score of 10.0 (NVD).
The flaw is published as VDE CERT advisory VDE-2020-016, which NVD lists as a Third Party Advisory reference for this CVE (VDE CERT VDE-2020-016).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0140 (72.7th percentile) as of 2026-11-08 — the highest EPSS of the four rail/roadway-ITS controller CVEs reviewed alongside it (CISA KEV, FIRST EPSS).
Operators running CPU LS4000 Series controllers with "G4..." firmware should disable or firewall the debug port per SWARCO's guidance and segment traffic-signal control networks from untrusted access.
Evidence
- An open port used for debugging in SWARCO's CPU LS4000 Series with firmware versions starting with G4... grants root access to the device without access control via network. — NVD
- NVD Primary CVSS v3.1 score 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; VDE CERT recorded an identical Secondary score and vector, and NVD also records a CVSS v2.0 score of 10.0. — NVD
- SWARCO TRAFFIC SYSTEMS GmbH manufactures the CPU LS4000, described as a traffic control device used in signal management systems; the advisory is published as VDE-2020-016. — VDE CERT VDE-2020-016
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0140 (72.7th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What level of access does the open debug port actually grant?
The port grants full root access to the CPU LS4000 controller over the network with no access control whatsoever — not a limited diagnostic shell, but complete control of the device (per NVD; per VDE CERT VDE-2020-016).
What is the real-world impact of taking over a traffic signal controller this way?
NVD states a malicious user could use the open debug port "to get access to the device and disturb operations with connected devices," meaning an attacker could interfere with the traffic signal equipment the controller manages (per NVD).
Who publishes the advisory for this device, and what is it called?
The German VDE CERT, which handles vulnerability coordination for SWARCO TRAFFIC SYSTEMS GmbH, published this as advisory VDE-2020-016 (per VDE CERT VDE-2020-016).
How likely is exploitation compared to other similar controller flaws?
This CVE is not in the CISA KEV catalog as of catalog version 2026.11.06, but its FIRST EPSS score of 0.0140 (72.7th percentile) as of 2026-11-08 is the highest of the roadway/rail-ITS controller CVEs reviewed alongside it, consistent with its maximum CVSS score and unauthenticated root-level impact (per CISA KEV; per FIRST EPSS).