Description
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Pepperl+Fuchs P+F Comtrol RocketLinx
ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT allaffectedES7510-XT to < 2.1.1affectedES8510 to < 3.1.1affected
Pepperl+Fuchs P+F Comtrol RocketLinx
ICRL-M-8RJ45/4SFP-G-DIN to ≤ 1.2.3affectedICRL-M-16RJ45/4CP-G-DIN to ≤ 1.2.3affected
Korenix JetNet
5428G-20SFP to ≤ V1.0affected5810G to ≤ V1.1affected4706F to ≤ V2.3baffected4510 to ≤ V3.0baffected5310 to < V1.6affected
Westermo PMI-110-F2G
unspecified to < V1.8affected
References
- https://cert.vde.com/de-de/advisories/vde-2020-040 ↗
- http://seclists.org/fulldisclosure/2021/Jun/0 ↗
- http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html ↗
- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/ ↗
- https://cert.vde.com/en-us/advisories/vde-2020-053 ↗
- http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html ↗