#VU47408 Command Injection in PEPPERL+FUCHS products - CVE-2020-12503

Vulnerability identifier: #VU47408

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2020-12503

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
RocketLinx ES7510-XT
RocketLinx ES8509-XT
RocketLinx ES8510-XT
RocketLinx ES9528-XTv2
RocketLinx ES7506
RocketLinx ES7510
RocketLinx ES7528
RocketLinx ES8508
RocketLinx ES8508F
RocketLinx ES8510
RocketLinx ES8510-XTE
RocketLinx ES9528/ES9528-XT

Software vendor:
PEPPERL+FUCHS

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
• https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419