CVE-2020-12502

Katalog CVE

CVSS 8.8 · High EPSS 1,0%

Kerentanan Cross-Site Request Forgery (CSRF) pada pepperl-fuchs es7510-xt firmware, pepperl-fuchs es8509-xt firmware +21 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.

Rincian

Terbit di NVD

15 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentic... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authenti... exploit · advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2021/Jun/0 mailing list · advisory pihak ketiga
• https://cert.vde.com/de-de/advisories/vde-2020-040 advisory pihak ketiga
• https://cert.vde.com/en-us/advisories/vde-2020-053 advisory pihak ketiga
• https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-wes... exploit · advisory pihak ketiga