VDE-2024-033

csafDEpepperl_fuchs_psirt

PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial of service

view advisory published 2024-08-13

Vulnerabilities have been discovered in the product, mainly caused by HTML injection and crosssite-scripting. The impact of the vulnerability on the affected device may result in an information disclosure and denial of service.

01

describes (3)

Related CVEs.

IDseverity exploitable
CVE-2024-5849US——
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
CVE-2024-38502US——
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.
CVE-2024-38501US——
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
02

references

External citations — patches, advisories, analysis.

03

remediations (3)

  • Fixed

    Update to a new version of the firmware you are using: * SocketServer v11.66 * PROFINET v3.4.10 * PROFINET/Modbus v1.0.8 * EtherNet/IP v7.23 * EIP/Modbus v1.09 * Modbus Router v7.10 * Modbus Server v7.12 * Modbus TCP v7.12

  • Fixed

    Update to a new version of the firmware you are using: * SocketServer v11.66 * PROFINET v3.4.10 * PROFINET/Modbus v1.0.8 * EtherNet/IP v7.23 * EIP/Modbus v1.09 * Modbus Router v7.10 * Modbus Server v7.12 * Modbus TCP v7.12

  • Fixed

    Update to a new version of the firmware you are using: * SocketServer v11.66 * PROFINET v3.4.10 * PROFINET/Modbus v1.0.8 * EtherNet/IP v7.23 * EIP/Modbus v1.09 * Modbus Router v7.10 * Modbus Server v7.12 * Modbus TCP v7.12

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan