CVE-2020-12503

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-12503
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2021/Jun/0 Mailing List Third Party Advisory
https://cert.vde.com/de-de/advisories/vde-2020-040 Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2020-053 Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es7510-xt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es7510-xt:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es8509-xt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es8509-xt:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es8510-xt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es8510-xt:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es9528-xtv2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es9528-xtv2:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es7506_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es7506:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es7510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es7510:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es7528_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es7528:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es8508_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es8508:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es8508f_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es8508f:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es8510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es8510:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es8510-xte_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es8510-xte:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es9528_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es9528:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:pepperl-fuchs:es9528-xt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:es9528-xt:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:korenix:jetnet_5428g-20sfp_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5428g-20sfp:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:korenix:jetnet_5810g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5810g:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:korenix:jetnet_4706f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_4706f:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:korenix:jetnet_4706_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_4706:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:korenix:jetnet_4510_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_4510:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:korenix:jetnet_5010_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5010:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:korenix:jetnet_5310_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5310:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:korenix:jetnet_6095_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_6095:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din:-:*:*:*:*:*:*:*

Configuration 26 (hide)

AND
cpe:2.3:o:korenix:jetwave_2212x_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2212x:-:*:*:*:*:*:*:*

Configuration 27 (hide)

AND
cpe:2.3:o:korenix:jetwave_2212s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2212s:-:*:*:*:*:*:*:*

Configuration 28 (hide)

AND
cpe:2.3:o:korenix:jetwave_2212g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2212g:-:*:*:*:*:*:*:*

Configuration 29 (hide)

AND
cpe:2.3:o:korenix:jetwave_2311_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2311:-:*:*:*:*:*:*:*

Configuration 30 (hide)

AND
cpe:2.3:o:korenix:jetwave_3220_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_3220:-:*:*:*:*:*:*:*
History

29 Apr 2022, 15:29

Type Values Removed Values Added
First Time Korenix jetnet 5810g
Korenix jetnet 4706
Korenix jetnet 6095
Korenix jetwave 2212g
Korenix jetnet 5310
Korenix jetnet 5428g-20sfp
Korenix jetwave 2311 Firmware
Korenix jetwave 2212x Firmware
Korenix jetnet 5010 Firmware
Korenix jetnet 4706f Firmware
Korenix jetnet 5310 Firmware
Korenix jetwave 2311
Korenix jetwave 2212g Firmware
Korenix jetnet 4510 Firmware
Korenix jetnet 4706f
Korenix jetnet 5428g-20sfp Firmware
Korenix
Korenix jetwave 3220 Firmware
Korenix jetwave 2212s Firmware
Korenix jetwave 2212x
Korenix jetnet 4510
Korenix jetnet 5810g Firmware
Korenix jetnet 5010
Korenix jetwave 2212s
Korenix jetwave 3220
Korenix jetnet 6095 Firmware
Korenix jetnet 4706 Firmware
CPE cpe:2.3:o:korenix:jetnet_5310_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2212x:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetwave_2212x_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_4510_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_3220:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_4510:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetwave_3220_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_4706_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetwave_2212s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_5810g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:pepperl-fuchs:icrl-m-8rj45\/4sfp-g-din_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_5428g-20sfp_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2212g:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetwave_2311_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_5010_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_6095:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_6095_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2212s:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_4706f:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5810g:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5010:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_4706:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetwave_2212g_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetwave_2311:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5428g-20sfp:-:*:*:*:*:*:*:*
cpe:2.3:o:korenix:jetnet_4706f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:pepperl-fuchs:icrl-m-16rj45\/4cp-g-din_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:korenix:jetnet_5310:-:*:*:*:*:*:*:*
References (MISC) http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html - Third Party Advisory, VDB Entry (MISC) http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html - Exploit, Third Party Advisory, VDB Entry
References (MISC) http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html - (MISC) http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html - Exploit, Third Party Advisory, VDB Entry

04 Feb 2022, 20:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html -

04 Nov 2021, 17:03

Type Values Removed Values Added
References (CONFIRM) https://cert.vde.com/en-us/advisories/vde-2020-053 - (CONFIRM) https://cert.vde.com/en-us/advisories/vde-2020-053 - Third Party Advisory
References (FULLDISC) http://seclists.org/fulldisclosure/2021/Jun/0 - (FULLDISC) http://seclists.org/fulldisclosure/2021/Jun/0 - Mailing List, Third Party Advisory
References (MISC) http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html - (MISC) http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html - Third Party Advisory, VDB Entry
References (CONFIRM) https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/ - (CONFIRM) https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/ - Third Party Advisory
CWE CWE-863

11 Jun 2021, 16:15

Type Values Removed Values Added
CWE CWE-20
References
  • (CONFIRM) https://cert.vde.com/en-us/advisories/vde-2020-053 -
  • (CONFIRM) https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/ -

01 Jun 2021, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html -
CWE CWE-863 CWE-20

01 Jun 2021, 10:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2021/Jun/0 -
Information

Published : 2020-10-15 19:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-12503

Mitre link : CVE-2020-12503

CVE.ORG link : CVE-2020-12503

JSON object : View

Products Affected

pepperl-fuchs

  • es8508_firmware
  • es8510-xte
  • es7528_firmware
  • icrl-m-16rj45\/4cp-g-din_firmware
  • es7510
  • es8508
  • es9528-xtv2
  • es7510-xt_firmware
  • es8510-xt_firmware
  • es9528-xt
  • es8509-xt
  • es8508f_firmware
  • es7510_firmware
  • es9528-xt_firmware
  • es8508f
  • es8510
  • es8510-xt
  • es9528-xtv2_firmware
  • es7506
  • es7528
  • icrl-m-8rj45\/4sfp-g-din
  • es9528
  • es9528_firmware
  • es8510-xte_firmware
  • es7510-xt
  • es8509-xt_firmware
  • icrl-m-8rj45\/4sfp-g-din_firmware
  • es8510_firmware
  • icrl-m-16rj45\/4cp-g-din
  • es7506_firmware

korenix

  • jetnet_5010_firmware
  • jetwave_2212x
  • jetnet_6095_firmware
  • jetnet_4510_firmware
  • jetnet_6095
  • jetwave_2212x_firmware
  • jetnet_5310
  • jetnet_5010
  • jetnet_5810g_firmware
  • jetnet_4706f
  • jetnet_5810g
  • jetwave_2212s
  • jetnet_4706
  • jetwave_3220_firmware
  • jetnet_5310_firmware
  • jetwave_2212g
  • jetnet_4706f_firmware
  • jetnet_5428g-20sfp_firmware
  • jetwave_2212s_firmware
  • jetwave_2311
  • jetwave_3220
  • jetnet_5428g-20sfp
  • jetnet_4510
  • jetwave_2311_firmware
  • jetnet_4706_firmware
  • jetwave_2212g_firmware
CWE
CWE-863

Incorrect Authorization