Summary
Critical vulnerabilities have been discovered in the product due to outdated software components.The impact of the vulnerabilities on the affected device may result in
Denial of service
Bypassing of authentication
Information disclosure
Details
Impact
Pepperl+Fuchs analyzed and identified affected devices.An attacker
could cause the web server to crash via the network. The remaining function of the gateway is not affected by this.
could by-pass authentication by falsifying cookies.
could reset the TCP connection as man-in-the-middle.
could read HTTP headers as man-in-the-middle.
Mitigation
External protective measures are required:
Disable the webserver after configuration, if possible, by following these steps:
- Enable SSH via the web server.
- Login to the SSH server.
- Disable the webserver via SSH portal.
- Reboot the device.
or:
- Use HTTPS rather than HTTP while using the webserver.
- Minimize network exposure for affected products and ensure that they are not accessible via the Internet.
- Isolate affected products from the corporate network.
- If remote access is required, use secure methods such as virtual private networks(VPNs).
Pepperl+Fuchs will provide an update to address some of these vulnerabilities in the future.
Vulnerabilities 8
-
Medium 6.5
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
-
Medium 5.3
Special characters break path parsing in XML functions
In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function …
-
Medium 4.3
PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such p…
-
Medium 4.0
ICMP information such as (1) netmask and (2) timestamp is allowed from arbitrary hosts.
-
Unscored —
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…
-
Unscored —
TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial …
-
Unscored —
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firef…
-
Unscored —
The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecess…
Revision history
-
#3.0.0
added score to vulnerability, Added CPEs, added last affected products to vulnerabilities
-
#2.0.0
Fix: quotation mark
-
#1.0.0
Initial revision.
References
-
VDE-2024-017: Pepperl+Fuchs: ICE2- * and ICE3- * are affected by multiple vulnerabilities - HTML
https://certvde.com/en/advisories/VDE-2024-017/
-
Pepperl+Fuchs PSIRT
https://www.pepperl-fuchs.com/de-de/support/benachrichtigungen-und-updates/cybersecurity-information-and-reporting-gp43254
-
CERT@VDE Security Advisories for Pepperl+Fuchs SE
https://certvde.com/en/advisories/vendor/pepperl-fuchs/