#VU49568 Command Injection in PEPPERL+FUCHS products - CVE-2020-12513

Vulnerability identifier: #VU49568

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2020-12513

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
IO-Link Master
IO-Link Master DR-8-PNIO-T
IO-Link Master DR-8-PNIO-P
IO-Link Master DR-8-PNIO
IO-Link Master 8-PNIO-L
IO-Link Master 8-PNIO
IO-Link Master 4-PNIO
IO-Link Master DR-8-EIP-T
IO-Link Master DR-8-EIP-P
IO-Link Master 8-EIP-L
IO-Link Master 8-EIP
IO-Link Master 4-EIP

Software vendor:
PEPPERL+FUCHS

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in the web-interface. A remote authenticated attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-pepperl-fuchs-io-link-master-series/