PT-2020-13145 · Pepperl+Fuchs · Pepperl+Fuchs P+F Comtrol Rocketlinx Es7506+7
T. Weber
+1
·
Published
2020-10-15
·
Updated
2022-04-29
·
CVE-2020-12500
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions)
Description
The issue allows unauthenticated device administration due to an improper authorization vulnerability. This means that devices can be administered without proper authentication, potentially leading to unauthorized access and control.
Recommendations
For all versions of the affected devices, consider restricting access to device administration interfaces until a proper fix is applied. As a temporary workaround, limiting access to the devices and their administration interfaces can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pepperl+Fuchs P+F Comtrol Rocketlinx Es7506
Pepperl+Fuchs P+F Comtrol Rocketlinx Es7510
Pepperl+Fuchs P+F Comtrol Rocketlinx Es7528
Pepperl+Fuchs P+F Comtrol Rocketlinx Es8508
Pepperl+Fuchs P+F Comtrol Rocketlinx Es8509-Xt
Pepperl+Fuchs P+F Comtrol Rocketlinx Es8510
Pepperl+Fuchs P+F Comtrol Rocketlinx Es9528
Pepperl+Fuchs P+F Comtrol Rocketlinx Es9528-Xtv2