CVE-2020-12500: Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Published Oct 15, 2020

Updated

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) allows unauthenticated device administration.

Affected Software

26 affected components

Pepperl-fuchs Es7510-xt Firmware

Pepperl-fuchs Es7510-xt

Pepperl-fuchs Es8509-xt Firmware

Pepperl-fuchs Es8509-xt

Pepperl-fuchs Es8510-xt Firmware

Pepperl-fuchs Es8510-xt

Pepperl-fuchs Es9528-xtv2 Firmware

Pepperl-fuchs Es9528-xtv2

Pepperl-fuchs Es7506 Firmware

Pepperl-fuchs Es7506

Pepperl-fuchs Es7510 Firmware

Pepperl-fuchs Es7510

Pepperl-fuchs Es7528 Firmware

Pepperl-fuchs Es7528

Pepperl-fuchs Es8508 Firmware

Pepperl-fuchs Es8508

Pepperl-fuchs Es8508f Firmware

Pepperl-fuchs Es8508f

Pepperl-fuchs Es8510 Firmware

Pepperl-fuchs Es8510

Pepperl-fuchs Es8510-xte Firmware

Pepperl-fuchs Es8510-xte

Pepperl-fuchs Es9528 Firmware

Pepperl-fuchs Es9528

Pepperl-fuchs Es9528-xt Firmware

Pepperl-fuchs Es9528-xt

Remediation

Information

An external protective measure is required. 1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially traffic targeting the administration webpage. 2) Administrator and user access should be protected by a secure password and only be available to a very limited group of people.

Event History

Oct 15, 2020

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-12500?

CVE-2020-12500 refers to an Improper Authorization vulnerability in Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) that allows unauthenticated device administration.

How severe is CVE-2020-12500?

CVE-2020-12500 has a severity rating of 9.8 (Critical).

How does CVE-2020-12500 affect Pepperl+Fuchs devices?

CVE-2020-12500 affects Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) by allowing unauthenticated device administration.

Is Pepperl+Fuchs ES7510-XT vulnerable to CVE-2020-12500?

Pepperl+Fuchs ES7510-XT is vulnerable to CVE-2020-12500.

How can I fix CVE-2020-12500 on Pepperl+Fuchs devices?

To fix CVE-2020-12500 on Pepperl+Fuchs devices, it is recommended to apply the latest firmware update provided by Pepperl+Fuchs.