CVE-2020-12513: Pepper+Fuchs Comtrol IO-Link Master OS Command Injection
Published Jan 22, 2021
·Updated
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.
Affected Software
24 affected components
Pepperl-fuchs Io-link Master 4-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master 4-eip
Pepperl-fuchs Io-link Master 8-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-eip
Pepperl-fuchs Io-link Master 8-eip-l Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-eip-l
Pepperl-fuchs Io-link Master Dr-8-eip Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip
Pepperl-fuchs Io-link Master Dr-8-eip-p Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip-p
Pepperl-fuchs Io-link Master Dr-8-eip-t Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-eip-t
Pepperl-fuchs Io-link Master 4-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master 4-pnio
Pepperl-fuchs Io-link Master 8-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-pnio
Pepperl-fuchs Io-link Master 8-pnio-l Firmware<=1.5.48
Pepperl-fuchs Io-link Master 8-pnio-l
Pepperl-fuchs Io-link Master Dr-8-pnio Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio
Pepperl-fuchs Io-link Master Dr-8-pnio-p Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio-p
Pepperl-fuchs Io-link Master Dr-8-pnio-t Firmware<=1.5.48
Pepperl-fuchs Io-link Master Dr-8-pnio-t
Remediation
Information
In order to prevent the exploitation of the reported vulnerabilities, we recommend that the
affected units be updated with the following three firmware packages:
U-Boot bootloader version 1.36 or newer
System image version 1.52 or newer
Application base version 1.6.11 or newer
Event History
Jan 22, 2021
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-12513?
CVE-2020-12513 is a vulnerability in Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below, which allows for an authenticated blind OS Command Injection.
2
How severe is CVE-2020-12513?
CVE-2020-12513 has a severity rating of 8.8 (Critical).
3
Which software versions are affected by CVE-2020-12513?
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is affected by CVE-2020-12513.
4
How can I fix CVE-2020-12513?
To fix CVE-2020-12513, it is recommended to update Pepperl+Fuchs Comtrol IO-Link Master to a version above 1.5.48.
5
Where can I find more information about CVE-2020-12513?
You can find more information about CVE-2020-12513 at the following reference: [https://cert.vde.com/en-us/advisories/vde-2020-038](https://cert.vde.com/en-us/advisories/vde-2020-038)