Skip to content
OpenAdvisories
Critical VDE-2020-053 3 CVEs

Pepperl+Fuchs: Comtrol RocketLinx ICRL-M - Multiple Vulnerabilities

Published Mar 8, 2021 · Updated May 22, 2025 · Revision 3

Vendor: Pepperl+Fuchs Product: ICRL-M-8RJ45/4SFP-G-DIN

Summary

Several critical vulnerabilities within firmware.

Details

Impact
Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit multiple vulnerabilities to get access to the device and execute any program and tap information.

Remediations
For vulnerability CVE-2020-12502 'Cross-Site Request Forgery (CSRF)', CVE-2020- 12503 'Multiple Authenticated Command Injections' and CVE-2020-12504 'Active TFTP- Service'

1. Update following products to the respective Firmware Version:

| Product ID | Firmware Version |
|------------------------------|-------------------|
| ICRL-M-8RJ45/4SFP-G-DIN | 1.4.0 |
| ICRL-M-16RJ45/4CP-G-DIN | 1.4.0 |

2. Deactivate TFTP-Service

Vulnerabilities 3

  • Critical 9.8
    CVE-2020-12504

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix P+F Comtrol RocketLinx
  • High 8.8
    CVE-2020-12502

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix JetNet
  • High 7.2
    CVE-2020-12503 EPSS 23%

    Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

    Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/…

    Pepperl+Fuchs Westermo Korenix JetNet

Revision history

  1. #3

    Fix: reference category, added distribution, quotation mark

  2. #2

    Fix: corrected self-reference, fixed version

  3. #1

    initial revision

References