Pepperl+Fuchs: Multiple DTM and VisuNet Software affected by log4net vulnerability

Mitigation
External countermeasures are needed for the remaining products.
The following protective measure is required for VisuNet devices and the PCs/Servers with an installed DTM: \
Restrict local access to the device, PC/Server and use user authentication to prevent unauthorized access.

Remediation
The following affected DTM products can be updated to the listed version:

| Item | Version |
|--------------------------------------------|----------------|
| FieldConnex DTM Collection | 1.7.1.2159 |
| Diagnostic Manager | 2.2.3.3527 |
| FieldConnex Diagnostic Gateway FF DTM | 2.2.3.3527 |
| FDH-1 Manager | 1.0.2.1049 |
| ABB Project Builder | 1.1.2.1134 |
| Honeywell Integration Package | 1.1.3.0 |
| Emerson Integration Package [ADM Project Builder Emerson] | 1.1.4.1474 |
| Emerson Integration Package [AMS Alert Adapter] | 1.1.3.72 |
| DTM Collection HART-Multiplexer | 2.0.1.208 |

**UPDATE A**

The following affected VisuNet products can be updated to the listed version:

| Item | Version |
|------------------------------------------|---------------|
| VisuNet RM Shell 5 (2016 LTSB) | 5.5.1.1200 |
| VisuNet RM Shell 5 (2019 LTSC) | 5.6.0.1383 |
| VisuNet Factory Reset | 6.1.1.262 |
| VisuNet Control Center | 4.8.0.1596 |
| VisuNet GXP PC Service Tool | 1.1.1 |

END UPDATE A

Impact
Pepperl+Fuchs analyzed and identified affected devices.
In table 'Affected products' packages are listed next to some products, this means that the products are only affected if the corresponding software is installed since the package implements the vulnerability.

To exploit the vulnerability, the access rights of an authorized user or admin are required.

The impact of the vulnerability on the affected products may result in

- Denial of Service
- Loss of Credentials
- Code Execution

The CVSS environmental score is specific to the customer's environment and should therefore be individually assessed by the customer to accomplish final scoring.