{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] }, { "names": [ "T.Weber" ], "organization": "SEC Consult Vulnerability Lab", "summary": "reported" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Several vulnerabilities exist within firmware versions up to and including v1.5.48.", "title": "Summary" }, { "category": "description", "text": "Pepperl+Fuchs analyzed and identified affected devices.\nRemote attackers may exploit multiple vulnerabilities to get access to the device and\nexecute any program and tap information.", "title": "Impact" }, { "category": "description", "text": "In order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n\n- System image version 1.52\n\n- Application base version 1.6.11", "title": "Remediation" }, { "category": "general", "text": "1. An external protective measure to be put in place.\nTraffic from untrusted networks to the device should be blocked by a firewall.\nEspecially traffic targeting the administration webpage.\n2. Device user accounts to be enabled with secure passwords.\nIf non-trusted people/applications have access to the network that the device is connected to, then configuring passwords for all three User Accounts is recommend.", "title": "General Recommendation" } ], "publisher": { "category": "vendor", "contact_details": "cert@pepperl-fuchs.com", "name": "Pepperl+Fuchs SE", "namespace": "https://www.pepperl-fuchs.com" }, "references": [ { "category": "self", "summary": "VDE-2020-038: Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master - HTML", "url": "https://certvde.com/de/advisories/VDE-2020-038/" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Pepperl+Fuchs", "url": "https://certvde.com/de/advisories/vendor/pepperl+fuchs/" }, { "category": "self", "summary": "VDE-2020-038: Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master - CSAF", "url": "https://pepperl-fuchs.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2020-038.json" } ], "title": "Pepperl+Fuchs: Multiple vulnerabilites in Comtrol IO-Link Master", "tracking": { "aliases": [ "VDE-2020-038" ], "current_release_date": "2025-05-14T13:00:14.000Z", "generator": { "date": "2024-11-25T13:51:21.125Z", "engine": { "name": "Secvisogram", "version": "2.5.15" } }, "id": "VDE-2020-038", "initial_release_date": "2021-01-04T13:01:00.000Z", "revision_history": [ { "date": "2021-01-04T13:01:00.000Z", "number": "1", "summary": "initial revision" }, { "date": "2025-02-12T16:57:59.000Z", "number": "2", "summary": "Fix: corrected self-reference, fixed version" }, { "date": "2025-05-14T13:00:14.000Z", "number": "3", "summary": "Fix: added distribution" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "IO-Link Master 4-EIP", "product": { "name": "IO-Link Master 4-EIP", "product_id": "CSAFPID-11001" } }, { "category": "product_name", "name": "IO-Link Master 4-PNIO", "product": { "name": "IO-Link Master 4-PNIO", "product_id": "CSAFPID-11002" } }, { "category": "product_name", "name": "IO-Link Master 8-EIP", "product": { "name": "IO-Link Master 8-EIP", "product_id": "CSAFPID-11003" } }, { "category": "product_name", "name": "IO-Link Master 8-EIP-L", "product": { "name": "IO-Link Master 8-EIP-L", "product_id": "CSAFPID-11004" } }, { "category": "product_name", "name": "IO-Link Master 8-PNIO", "product": { "name": "IO-Link Master 8-PNIO", "product_id": "CSAFPID-11005" } }, { "category": "product_name", "name": "IO-Link Master 8-PNIO-L", "product": { "name": "IO-Link Master 8-PNIO-L", "product_id": "CSAFPID-11006" } }, { "category": "product_name", "name": "IO-Link Master DR-8-EIP", "product": { "name": "IO-Link Master DR-8-EIP", "product_id": "CSAFPID-11007" } }, { "category": "product_name", "name": "IO-Link Master DR-8-EIP-P", "product": { "name": "IO-Link Master DR-8-EIP-P", "product_id": "CSAFPID-11008" } }, { "category": "product_name", "name": "IO-Link Master DR-8-EIP-T", "product": { "name": "IO-Link Master DR-8-EIP-T", "product_id": "CSAFPID-11009" } }, { "category": "product_name", "name": "IO-Link Master DR-8-PNIO", "product": { "name": "IO-Link Master DR-8-PNIO", "product_id": "CSAFPID-11010" } }, { "category": "product_name", "name": "IO-Link Master DR-8-PNIO-P", "product": { "name": "IO-Link Master DR-8-PNIO-P", "product_id": "CSAFPID-11011" } }, { "category": "product_name", "name": "IO-Link Master DR-8-PNIO-T", "product": { "name": "IO-Link Master DR-8-PNIO-T", "product_id": "CSAFPID-11012" } } ], "category": "product_family", "name": "Hardware" }, { "branches": [ { "category": "product_version_range", "name": "<=v1.5.48", "product": { "name": "Firmware <=v1.5.48", "product_id": "CSAFPID-21001" } }, { "branches": [ { "category": "product_version", "name": "1.36", "product": { "name": "U-Boot bootloader 1.36", "product_id": "CSAFPID-22001" } } ], "category": "product_name", "name": "U-Boot bootloader" }, { "branches": [ { "category": "product_version", "name": "1.52", "product": { "name": "System image 1.52", "product_id": "CSAFPID-22002" } } ], "category": "product_name", "name": "System image" }, { "branches": [ { "category": "product_version", "name": "1.6.11", "product": { "name": "Application base 1.6.11", "product_id": "CSAFPID-22003" } } ], "category": "product_name", "name": "Application base" } ], "category": "product_family", "name": "Firmware" } ], "category": "vendor", "name": "Pepperl+Fuchs" } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ], "summary": "Affected products." }, { "group_id": "CSAFGID-0002", "product_ids": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "summary": "Fixed products." } ], "relationships": [ { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master 4-EIP", "product_id": "CSAFPID-31001" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master 4-PNIO", "product_id": "CSAFPID-31002" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master 8-EIP", "product_id": "CSAFPID-31003" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master 8-EIP-L", "product_id": "CSAFPID-31004" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master 8-PNIO", "product_id": "CSAFPID-31005" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master 8-PNIO-L", "product_id": "CSAFPID-31006" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11006" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master DR-8-EIP", "product_id": "CSAFPID-31007" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11007" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master DR-8-EIP-P", "product_id": "CSAFPID-31008" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11008" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master DR-8-EIP-T", "product_id": "CSAFPID-31009" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11009" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master DR-8-PNIO", "product_id": "CSAFPID-31010" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11010" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master DR-8-PNIO-P", "product_id": "CSAFPID-31011" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11011" }, { "category": "installed_on", "full_product_name": { "name": "Firmware <=v1.5.48 installed on IO-Link Master DR-8-PNIO-T", "product_id": "CSAFPID-31012" }, "product_reference": "CSAFPID-21001", "relates_to_product_reference": "CSAFPID-11012" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52", "product_id": "CSAFPID-32001" }, "product_reference": "CSAFPID-22003", "relates_to_product_reference": "CSAFPID-22002" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36", "product_id": "CSAFPID-32002" }, "product_reference": "CSAFPID-32001", "relates_to_product_reference": "CSAFPID-22001" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 4-EIP", "product_id": "CSAFPID-32003" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11001" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 4-PNIO", "product_id": "CSAFPID-32004" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11002" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-EIP", "product_id": "CSAFPID-32005" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11003" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-EIP-L", "product_id": "CSAFPID-32006" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11004" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-PNIO", "product_id": "CSAFPID-32007" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11005" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master 8-PNIO-L", "product_id": "CSAFPID-32008" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11006" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP", "product_id": "CSAFPID-32009" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11007" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP-P", "product_id": "CSAFPID-32010" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11008" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-EIP-T", "product_id": "CSAFPID-32011" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11009" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO", "product_id": "CSAFPID-32012" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11010" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO-P", "product_id": "CSAFPID-32013" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11011" }, { "category": "installed_on", "full_product_name": { "name": "Application base 1.6.11 installed on System image 1.52 installed on U-Boot bootloader 1.36 installed on IO-Link Master DR-8-PNIO-T", "product_id": "CSAFPID-32014" }, "product_reference": "CSAFPID-32002", "relates_to_product_reference": "CSAFPID-11012" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-12511", "cwe": { "id": "CWE-352", "name": "Cross-Site Request Forgery (CSRF)" }, "notes": [ { "category": "summary", "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface.", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] }, "remediations": [ { "category": "vendor_fix", "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] } ], "title": "CVE-2020-12511" }, { "cve": "CVE-2020-12513", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "summary", "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] }, "remediations": [ { "category": "vendor_fix", "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 8.8, "environmentalSeverity": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 8.8, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] } ], "title": "CVE-2020-12513" }, { "cve": "CVE-2018-20679", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "summary", "text": "\nAn issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes.", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] }, "remediations": [ { "category": "vendor_fix", "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] } ], "title": "CVE-2018-20679" }, { "cve": "CVE-2018-0732", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "summary", "text": "During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] }, "remediations": [ { "category": "vendor_fix", "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "environmentalScore": 7.5, "environmentalSeverity": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 7.5, "temporalSeverity": "HIGH", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] } ], "title": "CVE-2018-0732" }, { "cve": "CVE-2020-12512", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "notes": [ { "category": "summary", "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] }, "remediations": [ { "category": "vendor_fix", "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] } ], "title": "CVE-2020-12512" }, { "cve": "CVE-2020-12514", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "summary", "text": "Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd", "title": "Summary" } ], "product_status": { "fixed": [ "CSAFPID-32003", "CSAFPID-32004", "CSAFPID-32005", "CSAFPID-32006", "CSAFPID-32007", "CSAFPID-32008", "CSAFPID-32009", "CSAFPID-32010", "CSAFPID-32011", "CSAFPID-32012", "CSAFPID-32013", "CSAFPID-32014" ], "known_affected": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] }, "remediations": [ { "category": "vendor_fix", "details": "\nIn order to prevent the exploitation of the reported vulnerabilities, we recommend that the\naffected units be updated with the following three firmware packages:\n\n- U-Boot bootloader version 1.36\n- System image version 1.52\n- Application base version 1.6.11", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 4.9, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "temporalScore": 4.9, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-31001", "CSAFPID-31002", "CSAFPID-31003", "CSAFPID-31004", "CSAFPID-31005", "CSAFPID-31006", "CSAFPID-31007", "CSAFPID-31008", "CSAFPID-31009", "CSAFPID-31010", "CSAFPID-31011", "CSAFPID-31012" ] } ], "title": "CVE-2020-12514" } ] }