Back to overview

Pepperl+Fuchs: Multiple Products prone to multiple vulnerabilities in Comtrol RocketLinux

VDE-2020-040
Last update
10/05/2020 14:00
Published at
10/05/2020 14:00
Vendor(s)
Pepperl+Fuchs SE
External ID
VDE-2020-040
CSAF Document
Download

Summary

Several critical vulnerabilities within Firmware have been identified. Please consult the CVEs for details.

Impact

Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit multiple vulnerabilities to get access to the device and
execute any program and tap information.

Affected Product(s)

Model no. Product name Affected versions
ES7506 Firmware vers:all/*
ES7506 Firmware vers:all/*
ES7510 Firmware vers:all/*
ES7510-XT Firmware vers:all/*
ES7528 Firmware vers:all/*
ES8508 Firmware vers:all/*
ES8508F Firmware vers:all/*
ES8509-XT Firmware vers:all/*
ES8510 Firmware vers:all/*
ES8510-XT Firmware vers:all/*
ES8510-XTE Firmware vers:all/*
ES9528/ES9528-XT Firmware vers:all/*

Vulnerabilities

Expand / Collapse all

Published
09/22/2025 14:57
Severity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
Use of Hard-coded Credentials (CWE-798)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
Hidden Functionality (CWE-912)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
Cross-Site Request Forgery (CSRF) (CWE-352)
References
cve.org | nvd.nist.gov

Published
09/22/2025 14:57
Severity
7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
Improper Input Validation (CWE-20)
References
cve.org | nvd.nist.gov

Mitigation

An external protective measure is required.

1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially
traffic targeting the administration webpage.

2) Administrator and user access should be protected by a secure password and only be
available to a very limited group of people.

Revision History

Version Date Summary
1 10/05/2020 14:00 initial revision