Skip to content
OpenAdvisories
Critical VDE-2025-002 1 CVE

PEPPERL+FUCHS: HMI – devices are affected by Windows RCE

Published Feb 25, 2025 · Updated May 22, 2025 · Revision 3

Vendor: Pepperl+Fuchs Product: BPC3200-* Product: BTC01-* Product: BTC12-* Product: BTC14-* Product: BTC22-* Product: BTC24-* Product: Native Windows Product: PC-320-* Product: PC2***-* Product: PC37***-* Product: PC82****-* Product: PC9****-* Product: PC97**-* Product: PCU1*100-* Product: RM-320-* Product: RM2***-* Product: RM37***-* Product: RM82***-* Product: RM9***-* Product: TCU1*00-* Product: VisuNet RM Shell 5 Product: VisuNet RM Shell 6

Summary

An unauthenticated attacker could repeatedly send IPv6 packets, that include specially crafted packets, to a Windows machine which could enable remote code execution.

Details

Impact
An unauthenticated remote attacker can<br>• read confidential information from the device<br>• modify or delete data on the device<br>• execute code on the device

Remediation
For the Windows Versions please install the '2024-08 Cumulative Update' from Microsoft.<br>For the RM Shell Versions please install:<br>RM Shell 5 based on Windows 10 LTSB 2016: 18-33624T Windows Cumulative Security Patch - 2024-08 for RM Image 5 based on Windows 10 LTSB 2016 (KB5041773) found at Thin Client Firmware VisuNet RM Shell 5 (2016 LTSB) (pepperl-fuchs.com).<br>RM Shell 5 based on Windows 10 LTSC 2019: 18-34182G Windows Cumulative Security Patch - 2024-08 for RM Image 5.5 based on Windows 10 LTSC 2019 (KB5041578) found at Thin Client Firmware VisuNet RM Shell 5 (2019 LTSC) (pepperl-fuchs.com).<br>RM Shell 6 based on Windows 10 LTSC 2021: 18-34927A RM Image Security Patch - Windows Cumulative Security Patch 2024-08 (KB5041580) and .Net (KB5042056) found at Thin Client Firmware VisuNet RM Shell 6 (pepperl-fuchs.com).

Vulnerabilities 1

Revision history

  1. #3

    Fix: added distribution, quotation mark

  2. #2

    fixed reference urls

  3. #1

    Initial revision.

References