PT-2021-9460 · Pepperl+Fuchs Comtrol · Io-Link Master

Published 2021-01-22 · Updated 2021-01-27 · CVE-2020-12512

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pepperl+Fuchs Comtrol IO-Link Master versions 1.5.48 and below

Description The issue is related to an authenticated reflected POST Cross-Site Scripting. This means that an attacker could potentially inject malicious scripts into the website, which would then be executed by the user's browser. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 1.5.48 and below, update to a version above 1.5.48 to resolve the issue. As a temporary workaround, consider restricting access to the POST endpoint to minimize the risk of exploitation. Avoid using the vulnerable IO-Link Master module in the affected version until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-12512

Affected Products

Io-Link Master

References · 4

• https://osv.dev/vulnerability/CVE-2020-12512 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12512 · Security Note
• https://t.me/cibsecurity/22538 · Telegram Post
• https://cert.vde.com/en-us/advisories/vde-2020-038 · Note