{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]},{"names":["T.Weber"],"organization":"SEC Consult Vulnerability Lab","summary":"reported"}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Several vulnerabilities exist within firmware versions up to and including v1.5.48.","title":"Summary"},{"category":"description","text":"Pepperl+Fuchs analyzed and identified affected devices.\nRemote attackers may exploit multiple vulnerabilities to get access to the device and\nexecute any program and tap information.","title":"Impact"},{"category":"description","text":"In order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n\n- System image version 1.52\n\n- Application base version 1.6.11","title":"Remediation"},{"category":"general","text":"1. An external protective measure to be put in place.\nTraffic from untrusted networks to the device should be blocked by a firewall.\nEspecially traffic targeting the administration webpage.\n2. Device user accounts to be enabled with secure passwords.\nIf non-trusted people/applications have access to the network that the device is connected to, then configuring passwords for all three User Accounts is recommend.","title":"General Recommendation"}],"publisher":{"category":"vendor","contact_details":"cert@pepperl-fuchs.com","name":"Pepperl+Fuchs SE","namespace":"https://www.pepperl-fuchs.com"},"references":[{"category":"self","summary":"VDE-2020-038: Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master - HTML","url":"https://certvde.com/de/advisories/VDE-2020-038/"},{"category":"external","summary":"CERT@VDE Security Advisories for Pepperl+Fuchs","url":"https://certvde.com/de/advisories/vendor/pepperl+fuchs/"},{"category":"self","summary":"VDE-2020-038: Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master - CSAF","url":"https://pepperl-fuchs.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2020-038.json"}],"title":"Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master","tracking":{"aliases":["VDE-2020-038"],"current_release_date":"2025-05-14T13:00:14.000Z","generator":{"date":"2024-11-25T13:51:21.125Z","engine":{"name":"Secvisogram","version":"2.5.15"}},"id":"VDE-2020-038","initial_release_date":"2021-01-04T13:01:00.000Z","revision_history":[{"date":"2021-01-04T13:01:00.000Z","number":"1","summary":"initial revision"},{"date":"2025-02-12T16:57:59.000Z","number":"2","summary":"Fix: corrected self-reference, fixed version"},{"date":"2025-05-14T13:00:14.000Z","number":"3","summary":"Fix: added distribution"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"IO-Link Master 4-EIP","product":{"name":"IO-Link Master 4-EIP","product_id":"CSAFPID-11001"}},{"category":"product_name","name":"IO-Link Master 4-PNIO","product":{"name":"IO-Link Master 4-PNIO","product_id":"CSAFPID-11002"}},{"category":"product_name","name":"IO-Link Master 8-EIP","product":{"name":"IO-Link Master 8-EIP","product_id":"CSAFPID-11003"}},{"category":"product_name","name":"IO-Link Master 8-EIP-L","product":{"name":"IO-Link Master 8-EIP-L","product_id":"CSAFPID-11004"}},{"category":"product_name","name":"IO-Link Master 8-PNIO","product":{"name":"IO-Link Master 8-PNIO","product_id":"CSAFPID-11005"}},{"category":"product_name","name":"IO-Link Master 8-PNIO-L","product":{"name":"IO-Link Master 8-PNIO-L","product_id":"CSAFPID-11006"}},{"category":"product_name","name":"IO-Link Master DR-8-EIP","product":{"name":"IO-Link Master DR-8-EIP","product_id":"CSAFPID-11007"}},{"category":"product_name","name":"IO-Link Master DR-8-EIP-P","product":{"name":"IO-Link Master DR-8-EIP-P","product_id":"CSAFPID-11008"}},{"category":"product_name","name":"IO-Link Master DR-8-EIP-T","product":{"name":"IO-Link Master DR-8-EIP-T","product_id":"CSAFPID-11009"}},{"category":"product_name","name":"IO-Link Master DR-8-PNIO","product":{"name":"IO-Link Master DR-8-PNIO","product_id":"CSAFPID-11010"}},{"category":"product_name","name":"IO-Link Master DR-8-PNIO-P","product":{"name":"IO-Link Master DR-8-PNIO-P","product_id":"CSAFPID-11011"}},{"category":"product_name","name":"IO-Link Master DR-8-PNIO-T","product":{"name":"IO-Link Master DR-8-PNIO-T","product_id":"CSAFPID-11012"}}],"category":"product_family","name":"Hardware"},{"branches":[{"category":"product_version_range","name":"<=v1.5.48","product":{"name":"Firmware <=v1.5.48","product_id":"CSAFPID-21001"}},{"branches":[{"category":"product_version","name":"1.36","product":{"name":"U-Boot bootloader 1.36","product_id":"CSAFPID-22001"}}],"category":"product_name","name":"U-Boot bootloader"},{"branches":[{"category":"product_version","name":"1.52","product":{"name":"System image 1.52","product_id":"CSAFPID-22002"}}],"category":"product_name","name":"System image"},{"branches":[{"category":"product_version","name":"1.6.11","product":{"name":"Application base 1.6.11","product_id":"CSAFPID-22003"}}],"category":"product_name","name":"Application base"}],"category":"product_family","name":"Firmware"}],"category":"vendor","name":"Pepperl+Fuchs"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"],"summary":"Affected products."},{"group_id":"CSAFGID-0002","product_ids":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"summary":"Fixed products."}],"relationships":[{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master 4-EIP","product_id":"CSAFPID-31001"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master 4-PNIO","product_id":"CSAFPID-31002"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master 8-EIP","product_id":"CSAFPID-31003"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master 8-EIP-L","product_id":"CSAFPID-31004"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master 8-PNIO","product_id":"CSAFPID-31005"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master 8-PNIO-L","product_id":"CSAFPID-31006"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master DR-8-EIP","product_id":"CSAFPID-31007"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master DR-8-EIP-P","product_id":"CSAFPID-31008"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11008"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master DR-8-EIP-T","product_id":"CSAFPID-31009"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11009"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master DR-8-PNIO","product_id":"CSAFPID-31010"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11010"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master DR-8-PNIO-P","product_id":"CSAFPID-31011"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11011"},{"category":"installed_on","full_product_name":{"name":"Firmware <=v1.5.48 installed on IO-Link Master DR-8-PNIO-T","product_id":"CSAFPID-31012"},"product_reference":"CSAFPID-21001","relates_to_product_reference":"CSAFPID-11012"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52","product_id":"CSAFPID-32001"},"product_reference":"CSAFPID-22003","relates_to_product_reference":"CSAFPID-22002"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36","product_id":"CSAFPID-32002"},"product_reference":"CSAFPID-32001","relates_to_product_reference":"CSAFPID-22001"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 4-EIP","product_id":"CSAFPID-32003"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11001"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 4-PNIO","product_id":"CSAFPID-32004"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11002"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-EIP","product_id":"CSAFPID-32005"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11003"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-EIP-L","product_id":"CSAFPID-32006"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11004"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-PNIO","product_id":"CSAFPID-32007"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11005"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-PNIO-L","product_id":"CSAFPID-32008"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11006"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP","product_id":"CSAFPID-32009"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11007"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP-P","product_id":"CSAFPID-32010"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11008"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP-T","product_id":"CSAFPID-32011"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11009"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO","product_id":"CSAFPID-32012"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11010"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO-P","product_id":"CSAFPID-32013"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11011"},{"category":"installed_on","full_product_name":{"name":"Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO-T","product_id":"CSAFPID-32014"},"product_reference":"CSAFPID-32002","relates_to_product_reference":"CSAFPID-11012"}]},"vulnerabilities":[{"cve":"CVE-2020-12511","cwe":{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)"},"notes":[{"category":"summary","text":"Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.","title":"Summary"}],"product_status":{"fixed":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]},"remediations":[{"category":"vendor_fix","details":"\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":8.8,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":8.8,"temporalSeverity":"HIGH","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]}],"title":"CVE-2020-12511"},{"cve":"CVE-2020-12513","cwe":{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"},"notes":[{"category":"summary","text":"Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.","title":"Summary"}],"product_status":{"fixed":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]},"remediations":[{"category":"vendor_fix","details":"\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":8.8,"environmentalSeverity":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","temporalScore":8.8,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]}],"title":"CVE-2020-12513"},{"cve":"CVE-2018-20679","cwe":{"id":"CWE-125","name":"Out-of-bounds Read"},"notes":[{"category":"summary","text":"\nAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.","title":"Summary"}],"product_status":{"fixed":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]},"remediations":[{"category":"vendor_fix","details":"\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","environmentalScore":7.5,"environmentalSeverity":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":7.5,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.0"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]}],"title":"CVE-2018-20679"},{"cve":"CVE-2018-0732","cwe":{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input"},"notes":[{"category":"summary","text":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).","title":"Summary"}],"product_status":{"fixed":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]},"remediations":[{"category":"vendor_fix","details":"\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","environmentalScore":7.5,"environmentalSeverity":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":7.5,"temporalSeverity":"HIGH","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]}],"title":"CVE-2018-0732"},{"cve":"CVE-2020-12512","cwe":{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"},"notes":[{"category":"summary","text":"Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting","title":"Summary"}],"product_status":{"fixed":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]},"remediations":[{"category":"vendor_fix","details":"\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","environmentalScore":5.4,"environmentalSeverity":"MEDIUM","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","temporalScore":5.4,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]}],"title":"CVE-2020-12512"},{"cve":"CVE-2020-12514","cwe":{"id":"CWE-476","name":"NULL Pointer Dereference"},"notes":[{"category":"summary","text":"Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd","title":"Summary"}],"product_status":{"fixed":["CSAFPID-32003","CSAFPID-32004","CSAFPID-32005","CSAFPID-32006","CSAFPID-32007","CSAFPID-32008","CSAFPID-32009","CSAFPID-32010","CSAFPID-32011","CSAFPID-32012","CSAFPID-32013","CSAFPID-32014"],"known_affected":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]},"remediations":[{"category":"vendor_fix","details":"\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","environmentalScore":4.9,"environmentalSeverity":"MEDIUM","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","temporalScore":4.9,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["CSAFPID-31001","CSAFPID-31002","CSAFPID-31003","CSAFPID-31004","CSAFPID-31005","CSAFPID-31006","CSAFPID-31007","CSAFPID-31008","CSAFPID-31009","CSAFPID-31010","CSAFPID-31011","CSAFPID-31012"]}],"title":"CVE-2020-12514"}]}