Pepperl+Fuchs: Anonymous FTP server and Telnet access allows information disclosure and manipulation
Critical vulnerabilities has been discovered in the product, mainly caused by ananonymous FTP server and Telnet access.The impact of the vulnerabilities on the affected device may result in Information disclosure Denial of service Device manipulation
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-6422US | —OT elevated | — | ||
An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. | ||||
| CVE-2024-6421US | — | — | ||
An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. | ||||
references
External citations — patches, advisories, analysis.
- VDE-2024-038: Pepperl+Fuchs: Anonymous FTP server and Telnet access allows information disclosure and manipulation - HTMLself
- CERT@VDE Security Advisories for Pepperl+Fuchs SEexternal
- VDE-2024-038: Pepperl+Fuchs: Anonymous FTP server and Telnet access allows information disclosure and manipulation - CSAFself
- Pepperl+Fuchs PSIRTexternal
remediations (2)
- Mitigation
An external protective measure is required. Minimize network exposure for affected products and ensure that they are not accessible via the Internet. Isolate affected products from the corporate network. If remote access is required, use secure methods such as virtual private networks (VPNs).
- Mitigation
An external protective measure is required. Minimize network exposure for affected products and ensure that they are not accessible via the Internet. Isolate affected products from the corporate network. If remote access is required, use secure methods such as virtual private networks (VPNs).
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan