CVE-2020-12512: Pepper+Fuchs Comtrol IO-Link Master Cross-Site Scripting
Published Jan 22, 2021
·Updated
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
Affected Software
24 affected components
Pepperl-fuchs Io-link Master 4-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master 4-eip
Pepperl-fuchs Io-link Master 8-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-eip
Pepperl-fuchs Io-link Master 8-eip-l Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-eip-l
Pepperl-fuchs Io-link Master Dr-8-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip
Pepperl-fuchs Io-link Master Dr-8-eip-p Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip-p
Pepperl-fuchs Io-link Master Dr-8-eip-t Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip-t
Pepperl-fuchs Io-link Master 4-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master 4-pnio
Pepperl-fuchs Io-link Master 8-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-pnio
Pepperl-fuchs Io-link Master 8-pnio-l Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-pnio-l
Pepperl-fuchs Io-link Master Dr-8-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio
Pepperl-fuchs Io-link Master Dr-8-pnio-p Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio-p
Pepperl-fuchs Io-link Master Dr-8-pnio-t Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio-t
Remediation
Information
In order to prevent the exploitation of the reported vulnerabilities, we recommend that the
affected units be updated with the following three firmware packages:
U-Boot bootloader version 1.36 or newer
System image version 1.52 or newer
Application base version 1.6.11 or newer
Event History
Jan 22, 2021
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-12512?
CVE-2020-12512 is a vulnerability in Pepperl+Fuchs Comtrol IO-Link Master version 1.5.48 and below that allows for authenticated reflected POST Cross-Site Scripting.
2
What is the severity of CVE-2020-12512?
The severity of CVE-2020-12512 is high, with a severity value of 5.4.
3
How does CVE-2020-12512 affect Pepperl+Fuchs Comtrol IO-Link Master?
CVE-2020-12512 affects Pepperl+Fuchs Comtrol IO-Link Master versions 1.5.48 and below by enabling authenticated reflected POST Cross-Site Scripting.
4
How can I fix CVE-2020-12512?
To fix CVE-2020-12512, users should update their Pepperl+Fuchs Comtrol IO-Link Master to a version above 1.5.48.
5
Where can I find more information about CVE-2020-12512?
More information about CVE-2020-12512 can be found at https://cert.vde.com/en-us/advisories/vde-2020-038.