Share: Email | Twitter

ID

VDE-2020-040

Published

2020-10-05 14:00 (CEST)

Last update

2020-10-05 14:00 (CEST)

Vendor(s)

Pepperl+Fuchs SE

Product(s)

Article No° Product Name Affected Version(s)
ES7506 all versions
ES7506 all versions
ES7510 all versions
ES7510-XT all versions
ES7528 all versions
ES8508 all versions
ES8508F all versions
ES8509-XT all versions
ES8510 all versions
ES8510-XT all versions
ES8510-XTE all versions
ES9528/ES9528-XT all versions
ES9528-XTv2 all versions

Summary

Several critical vulnerabilities within Firmware have been identified. Please consult the CVEs for details.

Vulnerabilities



CVE-2020-12504
9.8
Last Update
Oct. 8, 2020, 8:13 a.m.
Severity
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Hidden Functionality (CWE-912)
Summary
Active TFTP-Service
Details
nvd.nist.gov 
CVE-2020-12500
9.8
Last Update
Oct. 8, 2020, 8:11 a.m.
Severity
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Improper Authorization (CWE-285)
Summary

Unauthenticated Device Administration

Details
nvd.nist.gov 
CVE-2020-12501
9.8
Last Update
Oct. 8, 2020, 8:11 a.m.
Severity
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness
Use of Hardcoded Credentials (CWE-798)
Summary

Undocumented Accounts

Details
nvd.nist.gov 
CVE-2020-12502
8.8
Last Update
Oct. 8, 2020, 8:12 a.m.
Severity
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness
Cross-Site Request Forgery (CSRF) (CWE-352)
Summary

Unauthenticated Device Administration

Details
nvd.nist.gov 
CVE-2020-12503
7.2
Last Update
Oct. 8, 2020, 8:13 a.m.
Severity
7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness
Improper Input Validation (CWE-20)
Summary

Multiple Authenticated Command Injections

Details
nvd.nist.gov 

Impact

Pepperl+Fuchs analyzed and identified affected devices.
Remote attackers may exploit multiple vulnerabilities to get access to the device and
execute any program and tap information.

Solution

An external protective measure is required.

1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially
traffic targeting the administration webpage.

2) Administrator and user access should be protected by a secure password and only be
available to a very limited group of people.

Reported by

T. Weber of SEC Consult Vulnerability Lab reported this vulnerability.
Coordinated by CERT@VDE