CVE-2020-12511: Pepper+Fuchs Comtrol IO-Link Master Cross-Site Request Forgery
Published Jan 22, 2021
·Updated
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.
Affected Software
24 affected components
Pepperl-fuchs Io-link Master 4-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master 4-eip
Pepperl-fuchs Io-link Master 8-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-eip
Pepperl-fuchs Io-link Master 8-eip-l Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-eip-l
Pepperl-fuchs Io-link Master Dr-8-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip
Pepperl-fuchs Io-link Master Dr-8-eip-p Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip-p
Pepperl-fuchs Io-link Master Dr-8-eip-t Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip-t
Pepperl-fuchs Io-link Master 4-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master 4-pnio
Pepperl-fuchs Io-link Master 8-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-pnio
Pepperl-fuchs Io-link Master 8-pnio-l Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-pnio-l
Pepperl-fuchs Io-link Master Dr-8-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio
Pepperl-fuchs Io-link Master Dr-8-pnio-p Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio-p
Pepperl-fuchs Io-link Master Dr-8-pnio-t Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio-t
Remediation
Information
In order to prevent the exploitation of the reported vulnerabilities, we recommend that the
affected units be updated with the following three firmware packages:
U-Boot bootloader version 1.36 or newer
System image version 1.52 or newer
Application base version 1.6.11 or newer
Event History
Jan 22, 2021
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-12511?
CVE-2020-12511 is a vulnerability in Pepperl+Fuchs Comtrol IO-Link Master version 1.5.48 and below that allows for Cross-Site Request Forgery (CSRF) attacks.
2
What is the severity of CVE-2020-12511?
CVE-2020-12511 has a severity score of 8.8, which is considered high.
3
Which software versions are affected by CVE-2020-12511?
Pepperl+Fuchs Comtrol IO-Link Master versions 1.5.48 and below are affected by CVE-2020-12511.
4
How can I fix CVE-2020-12511?
To fix CVE-2020-12511, users should update their Pepperl+Fuchs Comtrol IO-Link Master to a version above 1.5.48.
5
Where can I find more information about CVE-2020-12511?
More information about CVE-2020-12511 can be found at the following link: https://cert.vde.com/en-us/advisories/vde-2020-038