Command Injection in PEPPERL+FUCHS products - CVE-2020-12513

Vulnerability identifier: #VU49568

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12513

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-interface. A remote authenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

IO-Link Master
IO-Link Master DR-8-PNIO-T
IO-Link Master DR-8-PNIO-P
IO-Link Master DR-8-PNIO
IO-Link Master 8-PNIO-L
IO-Link Master 8-PNIO
IO-Link Master 4-PNIO
IO-Link Master DR-8-EIP-T
IO-Link Master DR-8-EIP-P
IO-Link Master 8-EIP-L
IO-Link Master 8-EIP
IO-Link Master 4-EIP

Install updates from vendor's website.

IO-Link Master - update to 1.6.11
IO-Link Master DR-8-PNIO-T - update to 1.5.48
IO-Link Master DR-8-PNIO-P - update to 1.5.48
IO-Link Master DR-8-PNIO - update to 1.5.48
IO-Link Master 8-PNIO-L - update to 1.5.48
IO-Link Master 8-PNIO - update to 1.5.48
IO-Link Master 4-PNIO - update to 1.5.48
IO-Link Master DR-8-EIP-T - update to 1.5.48
IO-Link Master DR-8-EIP-P - update to 1.5.48
IO-Link Master 8-EIP-L - update to 1.5.48
IO-Link Master 8-EIP - update to 1.5.48
IO-Link Master 4-EIP - update to 1.5.48

• https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-pepperl-fuchs-io-link-master-series/

• Multiple vulnerabilities in Pepperl+Fuchs IO-Link Master Series