Skip to content
OpenAdvisories
High VDE-2020-038 6 CVEs

Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master

Published Jan 4, 2021 · Updated May 14, 2025 · Revision 3

Vendor: Pepperl+Fuchs Product: Application base Product: IO-Link Master 4-EIP Product: IO-Link Master 4-PNIO Product: IO-Link Master 8-EIP Product: IO-Link Master 8-EIP-L Product: IO-Link Master 8-PNIO Product: IO-Link Master 8-PNIO-L Product: IO-Link Master DR-8-EIP Product: IO-Link Master DR-8-EIP-P Product: IO-Link Master DR-8-EIP-T Product: IO-Link Master DR-8-PNIO Product: IO-Link Master DR-8-PNIO-P Product: IO-Link Master DR-8-PNIO-T Product: System image Product: U-Boot bootloader

Summary

Several vulnerabilities exist within firmware versions up to and including v1.5.48.

Details

Impact
Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit multiple vulnerabilities to get access to the device and
execute any program and tap information.

Remediation
In order to prevent the exploitation of the reported vulnerabilities, we recommend that the
affected units be updated with the following three firmware packages:

- U-Boot bootloader version 1.36

- System image version 1.52

- Application base version 1.6.11

Vulnerabilities 6

  • High 8.8
    CVE-2020-12511

    Pepper+Fuchs Comtrol IO-Link Master Cross-Site Request Forgery

    Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.

    Pepper+Fuchs Comtrol IO-Link Master
  • High 7.5
    CVE-2018-20679

    An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP serve…

    busybox busybox busybox Debian Ubuntu Alpine
  • High 7.5
    CVE-2020-12512

    Pepper+Fuchs Comtrol IO-Link Master Cross-Site Scripting

    Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting

    Pepper+Fuchs Comtrol IO-Link Master
  • High 7.5
    CVE-2020-12513 EPSS 31%

    Pepper+Fuchs Comtrol IO-Link Master OS Command Injection

    Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.

    Pepper+Fuchs Comtrol IO-Link Master
  • Medium 6.6
    CVE-2020-12514

    Pepper+Fuchs Comtrol IO-Link Master NULL Pointer Dereference

    Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd

    Pepper+Fuchs Comtrol IO-Link Master
  • Unscored —
    CVE-2018-0732 EPSS 47%

    Client DoS due to large DH parameter

    During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

Revision history

  1. #3

    Fix: added distribution

  2. #2

    Fix: corrected self-reference, fixed version

  3. #1

    initial revision

References