Multiple vulnerabilities in PEPPERL+FUCHS RocketLinx Series



Risk High
Patch available NO
Number of vulnerabilities 5
CVE-ID CVE-2020-12500
CVE-2020-12501
CVE-2020-12502
CVE-2020-12503
CVE-2020-12504
CWE-ID CWE-285
CWE-798
CWE-352
CWE-77
CWE-912
Exploitation vector Network
Public exploit N/A
Vulnerable software
 RocketLinx ES7510-XT
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES8509-XT
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES8510-XT
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES9528-XTv2
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES7506
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES7510
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES7528
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES8508
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES8508F
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES8510
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES8510-XTE
Hardware solutions / Routers & switches, VoIP, GSM, etc

RocketLinx ES9528/ES9528-XT
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor PEPPERL+FUCHS

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Improper Authorization

EUVDB-ID: #VU47405

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-12500

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to the affected devices can be managed via a Windows client program called "Jet View". A remote user can send a specially crafted request and bypass access restrictions.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RocketLinx ES7510-XT: 2.1b

RocketLinx ES8509-XT: 2.1a

RocketLinx ES8510-XT: 3.1a

RocketLinx ES9528-XTv2: 2.1a

RocketLinx ES7506: 2.1b

RocketLinx ES7510: 1.4

RocketLinx ES7528: All versions

RocketLinx ES8508: All versions

RocketLinx ES8508F: All versions

RocketLinx ES8510: 3.1a

RocketLinx ES8510-XTE: All versions

RocketLinx ES9528/ES9528-XT: All versions

CPE2.3 External links

https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use of hard-coded credentials

EUVDB-ID: #VU47406

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-12501

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable syste

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RocketLinx ES7510-XT: 2.1b

RocketLinx ES8509-XT: 2.1a

RocketLinx ES8510-XT: 3.1a

RocketLinx ES9528-XTv2: 2.1a

RocketLinx ES7506: 2.1b

RocketLinx ES7510: 1.4

RocketLinx ES7528: All versions

RocketLinx ES8508: All versions

RocketLinx ES8508F: All versions

RocketLinx ES8510: 3.1a

RocketLinx ES8510-XTE: All versions

RocketLinx ES9528/ES9528-XT: All versions

CPE2.3 External links

https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site request forgery

EUVDB-ID: #VU47407

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-12502

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RocketLinx ES7510-XT: 2.1b

RocketLinx ES8509-XT: 2.1a

RocketLinx ES8510-XT: 3.1a

RocketLinx ES9528-XTv2: 2.1a

RocketLinx ES7506: 2.1b

RocketLinx ES7510: 1.4

RocketLinx ES7528: All versions

RocketLinx ES8508: All versions

RocketLinx ES8508F: All versions

RocketLinx ES8510: 3.1a

RocketLinx ES8510-XTE: All versions

RocketLinx ES9528/ES9528-XT: All versions

CPE2.3 External links

https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Command Injection

EUVDB-ID: #VU47408

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-12503

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RocketLinx ES7510-XT: 2.1b

RocketLinx ES8509-XT: 2.1a

RocketLinx ES8510-XT: 3.1a

RocketLinx ES9528-XTv2: 2.1a

RocketLinx ES7506: 2.1b

RocketLinx ES7510: 1.4

RocketLinx ES7528: All versions

RocketLinx ES8508: All versions

RocketLinx ES8508F: All versions

RocketLinx ES8510: 3.1a

RocketLinx ES8510-XTE: All versions

RocketLinx ES9528/ES9528-XT: All versions

CPE2.3 External links

https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Hidden functionality

EUVDB-ID: #VU47409

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-12504

CWE-ID: CWE-912 - Hidden Functionality (Backdoor)

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system

The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote attacker can use this functionality to gain full access to the application and compromise the affected system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RocketLinx ES7510-XT: 2.1b

RocketLinx ES8509-XT: 2.1a

RocketLinx ES8510-XT: 3.1a

RocketLinx ES9528-XTv2: 2.1a

RocketLinx ES7506: 2.1b

RocketLinx ES7510: 1.4

RocketLinx ES7528: All versions

RocketLinx ES8508: All versions

RocketLinx ES8508F: All versions

RocketLinx ES8510: 3.1a

RocketLinx ES8510-XTE: All versions

RocketLinx ES9528/ES9528-XT: All versions

CPE2.3 External links

https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###