Skip to content
OpenAdvisories
High VDE-2019-004 5 CVEs

Pepperl+Fuchs: ecom Mobile Devices prone to BlueBorne Attack

Published Mar 14, 2019 · Updated Mar 14, 2019

Vendor: Pepperl+Fuchs Product: CT50-Ex Product: Cx70-Ex Product: Ex-Handy 09 Product: Ex-Handy 209 Product: i.roc Ci70-Ex Product: Pad-Ex 01 Product: Smart-Ex 01 Product: Smart-Ex 201 Product: Tab-Ex 01

Summary

A collection of Bluetooth attack vectors were discovered and related vulnerabilities known as "BlueBorne" were disclosed. These vulnerabilities collectively endanger amongst others Windows, Linux and mobile operating systems like Android or IOS. An unauthenticated attacker may take control of devices and perform commands or access sensitive data.

Details

Impact
An unauthenticated, remote attacker may be able to obtain private information about the device or user, execute arbitrary code on the device or perform a virtually invisible Man-in-the-middle (MitM) attack.

Remediation
Customers using affected Pepperl+Fuchs / ecom instruments products are recommended to update the device.

For released firmware updates see table below.

| Product | Date | Update Source |
|---------------------|-----------|----------------------|
| CT50-Ex Android | 09/2017 | FOTA-Update |
| CT50-Ex Windows | 10/2017 | Microsoft Update |
| Pad-Ex 01 | 09/2017 | Microsoft Update |
| Smart-Ex 01 | 09/2018 | FOTA-Update |
| Smart-Ex 201 | 10/2018 | FOTA-Update |

In case there is no update available, users should consider the following workaround:

Deactivation of Bluetooth on the device
Unused or not needed Bluetooth should be switched off / disabled on affected devices.

Vulnerabilities 5

  • Unscored —
    CVE-2017-0781 Public exploit EPSS 21%

    A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.…

    Google Android Android
  • Unscored —
    CVE-2017-0782

    A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.…

    Google Android Android
  • Unscored —
    CVE-2017-0783

    A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1…

    Google Android Android
  • Unscored —
    CVE-2017-0785 Public exploit EPSS 12%

    A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1…

    Google Android Android
  • Unscored —
    CVE-2017-8628

    Microsoft Bluetooth Driver in Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 151…

    Microsoft Microsoft Bluetooth Driver

Revision history

  1. #1

    Initial revision.

References