{"id":"CVE-2020-12502","state":"PUBLISHED","title":"Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products","description":"Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.","publishedAt":"2020-10-15T18:42:57.229Z","updatedAt":"2024-09-16T18:43:33.813Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["Pepperl+Fuchs P+F Comtrol RocketLinx","Korenix JetNet","Westermo PMI-110-F2G"],"affected":[{"vendor":"Pepperl+Fuchs","product":"P+F Comtrol RocketLinx","versions":[{"version":"ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F,  ES8510-XTE, ES9528/ES9528-XT all","status":"affected"},{"version":"ES7510-XT","status":"affected","lessThan":"2.1.1","versionType":"custom"},{"version":"ES8510","status":"affected","lessThan":"3.1.1","versionType":"custom"}]},{"vendor":"Pepperl+Fuchs","product":"P+F Comtrol RocketLinx","versions":[{"version":"ICRL-M-8RJ45/4SFP-G-DIN","status":"affected","lessThanOrEqual":"1.2.3","versionType":"custom"},{"version":"ICRL-M-16RJ45/4CP-G-DIN","status":"affected","lessThanOrEqual":"1.2.3","versionType":"custom"}]},{"vendor":"Korenix","product":"JetNet","versions":[{"version":"5428G-20SFP","status":"affected","lessThanOrEqual":"V1.0","versionType":"custom"},{"version":"5810G","status":"affected","lessThanOrEqual":"V1.1","versionType":"custom"},{"version":"4706F","status":"affected","lessThanOrEqual":"V2.3b","versionType":"custom"},{"version":"4510","status":"affected","lessThanOrEqual":"V3.0b","versionType":"custom"},{"version":"5310","status":"affected","lessThan":"V1.6","versionType":"custom"}]},{"vendor":"Westermo","product":"PMI-110-F2G","versions":[{"version":"unspecified","status":"affected","lessThan":"V1.8","versionType":"custom"}]}],"references":["https://cert.vde.com/de-de/advisories/vde-2020-040","http://seclists.org/fulldisclosure/2021/Jun/0","http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html","https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/","https://cert.vde.com/en-us/advisories/vde-2020-053","http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T19:46:27.697Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/12xxx/CVE-2020-12502.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-12502","state":"PUBLISHED","datePublished":"2020-10-15T18:42:57.229Z","dateUpdated":"2024-09-16T18:43:33.813Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2020-04-30T00:00:00.000Z"},"containers":{"cna":{"title":"Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products","descriptions":[{"lang":"en","value":"Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration."}],"affected":[{"vendor":"Pepperl+Fuchs","product":"P+F Comtrol RocketLinx","versions":[{"version":"ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F,  ES8510-XTE, ES9528/ES9528-XT all","status":"affected"},{"version":"ES7510-XT","status":"affected","lessThan":"2.1.1","versionType":"custom"},{"version":"ES8510","status":"affected","lessThan":"3.1.1","versionType":"custom"}]},{"vendor":"Pepperl+Fuchs","product":"P+F Comtrol RocketLinx","versions":[{"version":"ICRL-M-8RJ45/4SFP-G-DIN","status":"affected","lessThanOrEqual":"1.2.3","versionType":"custom"},{"version":"ICRL-M-16RJ45/4CP-G-DIN","status":"affected","lessThanOrEqual":"1.2.3","versionType":"custom"}]},{"vendor":"Korenix","product":"JetNet","versions":[{"version":"5428G-20SFP","status":"affected","lessThanOrEqual":"V1.0","versionType":"custom"},{"version":"5810G","status":"affected","lessThanOrEqual":"V1.1","versionType":"custom"},{"version":"4706F","status":"affected","lessThanOrEqual":"V2.3b","versionType":"custom"},{"version":"4510","status":"affected","lessThanOrEqual":"V3.0b","versionType":"custom"},{"version":"5310","status":"affected","lessThan":"V1.6","versionType":"custom"}]},{"vendor":"Westermo","product":"PMI-110-F2G","versions":[{"version":"unspecified","status":"affected","lessThan":"V1.8","versionType":"custom"}]}],"references":[{"url":"https://cert.vde.com/de-de/advisories/vde-2020-040","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2021/Jun/0","name":"20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html","tags":["x_refsource_MISC"]},{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/","tags":["x_refsource_CONFIRM"]},{"url":"https://cert.vde.com/en-us/advisories/vde-2020-053","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","dateUpdated":"2022-02-04T19:06:11.000Z","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c"},"credits":[{"lang":"en","value":"T. Weber (SEC Consult Vulnerability Lab)"},{"lang":"en","value":"Coordinated by CERT@VDE"}],"datePublic":"2020-10-07T00:00:00.000Z","solutions":[{"lang":"en","value":"An external protective measure is required.\n\n1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially\ntraffic targeting the administration webpage.\n\n2) Administrator and user access should be protected by a secure password and only be\navailable to a very limited group of people."}],"source":{"advisory":"VDE-2020-040","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"info@cert.vde.com","DATE_PUBLIC":"2020-10-07T13:10:00.000Z","ID":"CVE-2020-12502","STATE":"PUBLIC","TITLE":"Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"P+F Comtrol RocketLinx","version":{"version_data":[{"version_affected":"=","version_name":"ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F,  ES8510-XTE, ES9528/ES9528-XT","version_value":"all"},{"version_affected":"<","version_name":"ES7510-XT","version_value":"2.1.1"},{"version_affected":"<","version_name":"ES8510","version_value":"3.1.1"}]}},{"product_name":"P+F Comtrol RocketLinx","version":{"version_data":[{"version_affected":"<=","version_name":"ICRL-M-8RJ45/4SFP-G-DIN","version_value":"1.2.3"},{"version_affected":"<=","version_name":"ICRL-M-16RJ45/4CP-G-DIN","version_value":"1.2.3"}]}}]},"vendor_name":"Pepperl+Fuchs"},{"product":{"product_data":[{"product_name":"JetNet","version":{"version_data":[{"version_affected":"<=","version_name":"5428G-20SFP","version_value":"V1.0"},{"version_affected":"<=","version_name":"5810G","version_value":"V1.1"},{"version_affected":"<=","version_name":"4706F","version_value":"V2.3b"},{"version_affected":"<=","version_name":"4510","version_value":"V3.0b"},{"version_affected":"<","version_name":"5310","version_value":"V1.6"}]}}]},"vendor_name":"Korenix"},{"product":{"product_data":[{"product_name":"PMI-110-F2G","version":{"version_data":[{"version_affected":"<","version_value":"V1.8"}]}}]},"vendor_name":"Westermo"}]}},"credit":[{"lang":"eng","value":"T. Weber (SEC Consult Vulnerability Lab)"},{"lang":"eng","value":"Coordinated by CERT@VDE"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}]},"references":{"reference_data":[{"name":"https://cert.vde.com/de-de/advisories/vde-2020-040","refsource":"CONFIRM","url":"https://cert.vde.com/de-de/advisories/vde-2020-040"},{"name":"20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2021/Jun/0"},{"name":"http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html"},{"name":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/","refsource":"CONFIRM","url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/"},{"name":"https://cert.vde.com/en-us/advisories/vde-2020-053","refsource":"CONFIRM","url":"https://cert.vde.com/en-us/advisories/vde-2020-053"},{"name":"http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html"}]},"solution":[{"lang":"en","value":"An external protective measure is required.\n\n1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially\ntraffic targeting the administration webpage.\n\n2) Administrator and user access should be protected by a secure password and only be\navailable to a very limited group of people."}],"source":{"advisory":"VDE-2020-040","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://cert.vde.com/de-de/advisories/vde-2020-040","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Jun/0","name":"20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://cert.vde.com/en-us/advisories/vde-2020-053","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T11:56:52.083Z"}}]}}}