Command Injection in PEPPERL+FUCHS products - CVE-2020-12503

Vulnerability identifier: #VU47408

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12503

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

RocketLinx ES8509-XT
RocketLinx ES9528/ES9528-XT
RocketLinx ES8510-XTE
RocketLinx ES8510
RocketLinx ES8508F
RocketLinx ES8508
RocketLinx ES7528
RocketLinx ES7510
RocketLinx ES7506
RocketLinx ES9528-XTv2
RocketLinx ES8510-XT
RocketLinx ES7510-XT

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://packetstormsecurity.com/files/download/159469/SA-20201005-0.txt
• https://files.pepperl-fuchs.com/webcat/navi/productInfo/doct/tdoct6954__eng.pdf?v=20201005082419

• Multiple vulnerabilities in PEPPERL+FUCHS RocketLinx Series