NVD Vulnerability Detail

CVE-2020-12503

Summary	Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.
Publication Date	Oct. 16, 2020, 4:15 a.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 1:59 p.m.

CVSS3.1 : HIGH
スコア	7.2
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	高
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : MEDIUM
Score	6.5
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	単一
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es7510-xt_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es7510-xt:-:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es8509-xt_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es8509-xt:-:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es8510-xt_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es8510-xt:-:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es9528-xtv2_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es9528-xtv2:-:::::::*

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es7506_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es7506:-:::::::*

Configuration6		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es7510_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es7510:-:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es7528_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es7528:-:::::::*

Configuration8		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es8508_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es8508:-:::::::*

Configuration9		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es8508f_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es8508f:-:::::::*

Configuration10		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es8510_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es8510:-:::::::*

Configuration11		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es8510-xte_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es8510-xte:-:::::::*

Configuration12		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es9528_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es9528:-:::::::*

Configuration13		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:es9528-xt_firmware::::::::
execution environment
1	cpe:2.3:h:pepperl-fuchs:es9528-xt:-:::::::*

Configuration14		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din_firmware::::::::			1.3.1
execution environment
1	cpe:2.3:h:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din:-:::::::*

Configuration15		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din_firmware::::::::			1.3.1
execution environment
1	cpe:2.3:h:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din:-:::::::*

Configuration16		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_5428g-20sfp_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_5428g-20sfp:-:::::::*

Configuration17		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_5810g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_5810g:-:::::::*

Configuration18		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_4706f_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_4706f:-:::::::*

Configuration19		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_4706_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_4706:-:::::::*

Configuration20		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_4510_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_4510:-:::::::*

Configuration21		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_5010_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_5010:-:::::::*

Configuration22		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_5310_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_5310:-:::::::*

Configuration23		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetnet_6095_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetnet_6095:-:::::::*

Configuration24		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din_firmware:-:::::::*
execution environment
1	cpe:2.3:h:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din:-:::::::*

Configuration25		or higher	or less	more than	less than
cpe:2.3:o:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din_firmware:-:::::::*
execution environment
1	cpe:2.3:h:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din:-:::::::*

Configuration26		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetwave_2212x_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetwave_2212x:-:::::::*

Configuration27		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetwave_2212s_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetwave_2212s:-:::::::*

Configuration28		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetwave_2212g_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetwave_2212g:-:::::::*

Configuration29		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetwave_2311_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetwave_2311:-:::::::*

Configuration30		or higher	or less	more than	less than
cpe:2.3:o:korenix:jetwave_3220_firmware:-:::::::*
execution environment
1	cpe:2.3:h:korenix:jetwave_3220:-:::::::*

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html	Exploit Third Party Advisory VDB Entry
3	http://seclists.org/fulldisclosure/2021/Jun/0	Mailing List Third Party Advisory
4	https://cert.vde.com/de-de/advisories/vde-2020-040	Third Party Advisory
5	https://cert.vde.com/en-us/advisories/vde-2020-053	Third Party Advisory
6	https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/	Third Party Advisory
7	http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html	Exploit Third Party Advisory VDB Entry
8	https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/	Third Party Advisory
9	https://cert.vde.com/en-us/advisories/vde-2020-053	Third Party Advisory
10	https://cert.vde.com/de-de/advisories/vde-2020-040	Third Party Advisory
11	http://seclists.org/fulldisclosure/2021/Jun/0	Mailing List Third Party Advisory
12	http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

JVN Vulnerability Information

複数の Pepperl+Fuchs P+F Comtrol RocketLinx 製品における不正な認証に関する脆弱性

Title	複数の Pepperl+Fuchs P+F Comtrol RocketLinx 製品における不正な認証に関する脆弱性
Summary	複数の Pepperl+Fuchs P+F Comtrol RocketLinx 製品には、不正な認証に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Oct. 7, 2020, midnight
Registration Date	May 11, 2021, 1:50 p.m.
Last Update	May 11, 2021, 1:50 p.m.

Affected System

ピーアンドエフ

ES7506 ファームウェア

ES7510 ファームウェア

ES7510-XT ファームウェア

ES7528 ファームウェア

ES8508 ファームウェア

ES8508F ファームウェア

ES8509-XT ファームウェア

ES8510 ファームウェア

ES8510-XT ファームウェア

ES9528-XTV2 ファームウェア

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-12503	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12503
National Vulnerability Database (NVD)
2	CVE-2020-12503	https://nvd.nist.gov/vuln/detail/CVE-2020-12503

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-863	https://cwe.mitre.org/data/definitions/863.html

ベンダー情報

No	Name	URL
Pepperl+Fuchs
1	トップページ	https://www.pepperl-fuchs.com/japan/ja/index.htm

その他

No	Name	URL
関連文書
1	VDE-2020-040 (PEPPERL+FUCHS: Multiple Products prone to multiple vulnerabilities in Comtrol RocketLinux (Update C))	https://cert.vde.com/de-de/advisories/vde-2020-040

Change Log

No	Changed Details	Date of change
1	[2021年05月11日] 掲載	May 11, 2021, 1:50 p.m.