PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial of service

Summary

Details

Vulnerabilities 3

• High 7.1
  CVE-2024-38502

  Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows stored XSS

  An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.

  Pepperl+Fuchs ICDM-RX/PN-DB9/RJ45-PM ICDM-RX/EN1-DB9/RJ45-DIN ICDM-RX/TCP-DB9/RJ45-DIN
  Aug 13, 2024
• High 7.1
  CVE-2024-5849

  Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS

  An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.

  Pepperl+Fuchs ICDM-RX/PN-DB9/RJ45-DIN ICDM-RX/EN-2DB9/RJ45-DIN ICDM-RX/TCP-4DB9/2RJ45-PM
  Aug 13, 2024
• Medium 6.1
  CVE-2024-38501

  Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection

  An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.

  Pepperl+Fuchs ICDM-RX/PN1-DB9/RJ45-PM ICDM-RX/EN1-4DB9/2RJ45-DIN ICDM-RX/TCP-DB9/RJ45-PM
  Aug 13, 2024

Revision history

1. 2025-05-14 #3

   Fix: version space

2. 2024-11-06 #2

   Fix: correct certvde domain, added self-reference

3. 2024-08-13 #1

   Initial revision.

References

• Pepperl+Fuchs PSIRT
  https://www.pepperl-fuchs.com/global/en/29079.htm
• CERT@VDE Security Advisories for Pepperl+Fuchs
  https://certvde.com/en/advisories/vendor/Pepperl+Fuchs
• VDE-2024-033: PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial of service - HTML
  https://certvde.com/en/advisories/VDE-2024-033/