Log in Start free

Vulnerability · Published Oct 15, 2020 · Assigned by CERTVDE

CVE-2020-12502Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

High 8.8

In plain English

A high-severity cross-site request forgery in JetNet from Korenix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.0%top 36.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.

Affected products (as reported)

VendorProductVersions
Pepperl+Fuchs P+F Comtrol RocketLinx ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT allES7510-XT – before 2.1.1ES8510 – before 3.1.1
Pepperl+Fuchs P+F Comtrol RocketLinx ICRL-M-8RJ45/4SFP-G-DIN – through 1.2.3ICRL-M-16RJ45/4CP-G-DIN – through 1.2.3
Korenix JetNet 5428G-20SFP – through V1.05810G – through V1.14706F – through V2.3b4510 – through V3.0b5310 – before V1.6
Westermo PMI-110-F2G unspecified – before V1.8

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References