VDE-2020-038

Vulnerability from csaf_pepperlfuchsse - Published: 2021-01-04 13:01 - Updated: 2025-05-14 13:00
Summary
Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master
Notes
Summary: Several vulnerabilities exist within firmware versions up to and including v1.5.48.
Impact: Pepperl+Fuchs analyzed and identified affected devices. Remote attackers may exploit multiple vulnerabilities to get access to the device and execute any program and tap information.
Remediation: In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
General Recommendation: 1. An external protective measure to be put in place. Traffic from untrusted networks to the device should be blocked by a firewall. Especially traffic targeting the administration webpage. 2. Device user accounts to be enabled with secure passwords. If non-trusted people/applications have access to the network that the device is connected to, then configuring passwords for all three User Accounts is recommend.
CVE-2020-12511
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352 - Cross-Site Request Forgery (CSRF)
Vendor Fix In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
CVE-2020-12513
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vendor Fix In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
CVE-2018-20679
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-125 - Out-of-bounds Read
Vendor Fix In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
CVE-2018-0732
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1284 - Improper Validation of Specified Quantity in Input
Vendor Fix In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
CVE-2020-12512
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vendor Fix In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
CVE-2020-12514
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Vendor Fix In order to prevent the exploitation of the reported vulnerabilities, we recommend that the affected units be updated with the following three firmware packages: - U-Boot bootloader version 1.36 - System image version 1.52 - Application base version 1.6.11
References
Acknowledgments
CERT@VDE certvde.com
SEC Consult Vulnerability Lab T.Weber
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "T.Weber"
        ],
        "organization": "SEC Consult Vulnerability Lab",
        "summary": "reported"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Several vulnerabilities exist within firmware versions up to and including v1.5.48.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "Pepperl+Fuchs analyzed and identified affected devices.\nRemote attackers may exploit multiple vulnerabilities to get access to the device and\nexecute any program and tap information.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "In order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n\n- System image version 1.52\n\n- Application base version 1.6.11",
        "title": "Remediation"
      },
      {
        "category": "general",
        "text": "1. An external protective measure to be put in place.\nTraffic from untrusted networks to the device should be blocked by a firewall.\nEspecially traffic targeting the administration webpage.\n2. Device user accounts to be enabled with secure passwords.\nIf non-trusted people/applications have access to the network that the device is connected to, then configuring passwords for all three User Accounts is recommend.",
        "title": "General Recommendation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "cert@pepperl-fuchs.com",
      "name": "Pepperl+Fuchs SE",
      "namespace": "https://www.pepperl-fuchs.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2020-038: Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master - HTML",
        "url": "https://certvde.com/de/advisories/VDE-2020-038/"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Pepperl+Fuchs",
        "url": "https://certvde.com/de/advisories/vendor/pepperl+fuchs/"
      },
      {
        "category": "self",
        "summary": "VDE-2020-038: Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master - CSAF",
        "url": "https://pepperl-fuchs.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2020-038.json"
      }
    ],
    "title": "Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master",
    "tracking": {
      "aliases": [
        "VDE-2020-038"
      ],
      "current_release_date": "2025-05-14T13:00:14.000Z",
      "generator": {
        "date": "2024-11-25T13:51:21.125Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.15"
        }
      },
      "id": "VDE-2020-038",
      "initial_release_date": "2021-01-04T13:01:00.000Z",
      "revision_history": [
        {
          "date": "2021-01-04T13:01:00.000Z",
          "number": "1",
          "summary": "initial revision"
        },
        {
          "date": "2025-02-12T16:57:59.000Z",
          "number": "2",
          "summary": "Fix: corrected self-reference, fixed version"
        },
        {
          "date": "2025-05-14T13:00:14.000Z",
          "number": "3",
          "summary": "Fix: added distribution"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IO-Link Master 4-EIP",
                "product": {
                  "name": "IO-Link Master 4-EIP",
                  "product_id": "CSAFPID-11001"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master 4-PNIO",
                "product": {
                  "name": "IO-Link Master 4-PNIO",
                  "product_id": "CSAFPID-11002"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master 8-EIP",
                "product": {
                  "name": "IO-Link Master 8-EIP",
                  "product_id": "CSAFPID-11003"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master 8-EIP-L",
                "product": {
                  "name": "IO-Link Master 8-EIP-L",
                  "product_id": "CSAFPID-11004"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master 8-PNIO",
                "product": {
                  "name": "IO-Link Master 8-PNIO",
                  "product_id": "CSAFPID-11005"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master 8-PNIO-L",
                "product": {
                  "name": "IO-Link Master 8-PNIO-L",
                  "product_id": "CSAFPID-11006"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master DR-8-EIP",
                "product": {
                  "name": "IO-Link Master DR-8-EIP",
                  "product_id": "CSAFPID-11007"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master DR-8-EIP-P",
                "product": {
                  "name": "IO-Link Master DR-8-EIP-P",
                  "product_id": "CSAFPID-11008"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master DR-8-EIP-T",
                "product": {
                  "name": "IO-Link Master DR-8-EIP-T",
                  "product_id": "CSAFPID-11009"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master DR-8-PNIO",
                "product": {
                  "name": "IO-Link Master DR-8-PNIO",
                  "product_id": "CSAFPID-11010"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master DR-8-PNIO-P",
                "product": {
                  "name": "IO-Link Master DR-8-PNIO-P",
                  "product_id": "CSAFPID-11011"
                }
              },
              {
                "category": "product_name",
                "name": "IO-Link Master DR-8-PNIO-T",
                "product": {
                  "name": "IO-Link Master DR-8-PNIO-T",
                  "product_id": "CSAFPID-11012"
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=v1.5.48",
                "product": {
                  "name": "Firmware \u003c=v1.5.48",
                  "product_id": "CSAFPID-21001"
                }
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "1.36",
                    "product": {
                      "name": "U-Boot bootloader 1.36",
                      "product_id": "CSAFPID-22001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "U-Boot bootloader"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "1.52",
                    "product": {
                      "name": "System image 1.52",
                      "product_id": "CSAFPID-22002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "System image"
              },
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "1.6.11",
                    "product": {
                      "name": "Application base 1.6.11",
                      "product_id": "CSAFPID-22003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "Application base"
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          }
        ],
        "category": "vendor",
        "name": "Pepperl+Fuchs"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ],
        "summary": "Affected products."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master 4-EIP",
          "product_id": "CSAFPID-31001"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master 4-PNIO",
          "product_id": "CSAFPID-31002"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master 8-EIP",
          "product_id": "CSAFPID-31003"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master 8-EIP-L",
          "product_id": "CSAFPID-31004"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master 8-PNIO",
          "product_id": "CSAFPID-31005"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master 8-PNIO-L",
          "product_id": "CSAFPID-31006"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master DR-8-EIP",
          "product_id": "CSAFPID-31007"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master DR-8-EIP-P",
          "product_id": "CSAFPID-31008"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master DR-8-EIP-T",
          "product_id": "CSAFPID-31009"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master DR-8-PNIO",
          "product_id": "CSAFPID-31010"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master DR-8-PNIO-P",
          "product_id": "CSAFPID-31011"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware \u003c=v1.5.48 installed on IO-Link Master DR-8-PNIO-T",
          "product_id": "CSAFPID-31012"
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52",
          "product_id": "CSAFPID-32001"
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-22002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36",
          "product_id": "CSAFPID-32002"
        },
        "product_reference": "CSAFPID-32001",
        "relates_to_product_reference": "CSAFPID-22001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 4-EIP",
          "product_id": "CSAFPID-32003"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 4-PNIO",
          "product_id": "CSAFPID-32004"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-EIP",
          "product_id": "CSAFPID-32005"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-EIP-L",
          "product_id": "CSAFPID-32006"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-PNIO",
          "product_id": "CSAFPID-32007"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-PNIO-L",
          "product_id": "CSAFPID-32008"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP",
          "product_id": "CSAFPID-32009"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP-P",
          "product_id": "CSAFPID-32010"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP-T",
          "product_id": "CSAFPID-32011"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO",
          "product_id": "CSAFPID-32012"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO-P",
          "product_id": "CSAFPID-32013"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO-T",
          "product_id": "CSAFPID-32014"
        },
        "product_reference": "CSAFPID-32002",
        "relates_to_product_reference": "CSAFPID-11012"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-12511",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012"
          ]
        }
      ],
      "title": "CVE-2020-12511"
    },
    {
      "cve": "CVE-2020-12513",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012"
          ]
        }
      ],
      "title": "CVE-2020-12513"
    },
    {
      "cve": "CVE-2018-20679",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "\nAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012"
          ]
        }
      ],
      "title": "CVE-2018-20679"
    },
    {
      "cve": "CVE-2018-0732",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "notes": [
        {
          "category": "summary",
          "text": "During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.5,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012"
          ]
        }
      ],
      "title": "CVE-2018-0732"
    },
    {
      "cve": "CVE-2020-12512",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 5.4,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 5.4,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012"
          ]
        }
      ],
      "title": "CVE-2020-12512"
    },
    {
      "cve": "CVE-2020-12514",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd",
          "title": "Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "environmentalScore": 4.9,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "temporalScore": 4.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012"
          ]
        }
      ],
      "title": "CVE-2020-12514"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.