9.8

CVE-2020-12504

Exploit

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pepperl-fuchs ≫ Es7510-xt Firmware Version < 2.1.1
   Pepperl-fuchs ≫ Es7510-xt Version -
Pepperl-fuchs ≫ Es8510 Firmware Version < 3.1.1
   Pepperl-fuchs ≫ Es8510 Version -
Korenix ≫ Jetwave 2212s Firmware Version 1.5
   Korenix ≫ Jetwave 2212s Version -
Korenix ≫ Jetwave 2212g Firmware Version 1.4
   Korenix ≫ Jetwave 2212g Version -
Korenix ≫ Jetwave 2311 Firmware Version 1.2
   Korenix ≫ Jetwave 2311 Version -
Korenix ≫ Jetwave 3220 Firmware Version 1.2
   Korenix ≫ Jetwave 3220 Version -
Korenix ≫ Jetwave 3420 Firmware Version 1.1.3t
   Korenix ≫ Jetwave 3420 Version -
Korenix ≫ Jetwave 2212x Firmware Version 1.5
   Korenix ≫ Jetwave 2212x Version -
Korenix ≫ Jetwave 5428g-20sfp Firmware Version 1.0
   Korenix ≫ Jetwave 5428g-20sfp Version -
Korenix ≫ Jetwave 5810g Firmware Version 1.1
   Korenix ≫ Jetwave 5810g Version -
Korenix ≫ Jetwave 5310 Firmware Version 1.5
   Korenix ≫ Jetwave 5310 Version -
Korenix ≫ Jetwave 5010 Firmware Version 3.1a
   Korenix ≫ Jetwave 5010 Version -
Korenix ≫ Jetwave 4706f Firmware Version 2.3b
   Korenix ≫ Jetwave 4706f Version -
Korenix ≫ Jetwave 4706 Firmware Version 2.3b
   Korenix ≫ Jetwave 4706 Version -
Korenix ≫ Jetwave 4510 Firmware Version 3.0b
   Korenix ≫ Jetwave 4510 Version -
Westermo ≫ Pmi-110-f2g Firmware Version 1.5
   Westermo ≫ Pmi-110-f2g Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.02% 0.859
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
info@cert.vde.com 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-912 Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html
Third Party Advisory
Exploit
VDB Entry
http://seclists.org/fulldisclosure/2021/Jun/0
Third Party Advisory
Exploit
Mailing List
https://cert.vde.com/de-de/advisories/vde-2020-040
Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/
Third Party Advisory
Exploit
https://cert.vde.com/en-us/advisories/vde-2020-053
Third Party Advisory