Skip to content
OpenAdvisories
Critical VDE-2020-040 5 CVEs

Pepperl+Fuchs: Multiple Products prone to multiple vulnerabilities in Comtrol RocketLinux

Published Oct 5, 2020 · Updated Oct 5, 2020

Vendor: Pepperl+Fuchs Product: ES7506 Product: ES7510 Product: ES7510-XT Product: ES7528 Product: ES8508 Product: ES8508F Product: ES8509-XT Product: ES8510 Product: ES8510-XT Product: ES8510-XTE Product: ES9528-XTv2 Product: ES9528/ES9528-XT

Summary

Several critical vulnerabilities within Firmware have been identified. Please consult the CVEs for details.

Details

Impact
Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit multiple vulnerabilities to get access to the device and
execute any program and tap information.

Mitigation
An external protective measure is required.

1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially
traffic targeting the administration webpage.

2) Administrator and user access should be protected by a secure password and only be
available to a very limited group of people.

Vulnerabilities 5

  • Critical 9.8
    CVE-2020-12501

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.

    Pepperl+Fuchs Westermo Korenix JetNet
  • Critical 9.8
    CVE-2020-12504

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix P+F Comtrol RocketLinx
  • High 8.8
    CVE-2020-12502

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix JetNet
  • High 7.5
    CVE-2020-12513 EPSS 31%

    Pepper+Fuchs Comtrol IO-Link Master OS Command Injection

    Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.

    Pepper+Fuchs Comtrol IO-Link Master
  • High 7.2
    CVE-2020-12503 EPSS 23%

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix P+F Comtrol RocketLinx

Revision history

  1. #1

    initial revision

References