PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial of service
Vulnerabilities have been discovered in the product, mainly caused by HTML injection and crosssite-scripting. The impact of the vulnerability on the affected device may result in an information disclosure and denial of service.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-5849US | — | — | ||
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once. | ||||
| CVE-2024-38502US | — | — | ||
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. | ||||
| CVE-2024-38501US | — | — | ||
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2024-033: PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial of service - HTMLself
- CERT@VDE Security Advisories for Pepperl+Fuchsexternal
- VDE-2024-033: PEPPERL+FUCHS: Device Master ICDM-RX/* – Vulnerability may allow unauthenticated remote attacker information disclosure and denial of service - CSAFself
- Pepperl+Fuchs PSIRTexternal
Behebungen (3)
- Behoben
Update to a new version of the firmware you are using: * SocketServer v11.66 * PROFINET v3.4.10 * PROFINET/Modbus v1.0.8 * EtherNet/IP v7.23 * EIP/Modbus v1.09 * Modbus Router v7.10 * Modbus Server v7.12 * Modbus TCP v7.12
- Behoben
Update to a new version of the firmware you are using: * SocketServer v11.66 * PROFINET v3.4.10 * PROFINET/Modbus v1.0.8 * EtherNet/IP v7.23 * EIP/Modbus v1.09 * Modbus Router v7.10 * Modbus Server v7.12 * Modbus TCP v7.12
- Behoben
Update to a new version of the firmware you are using: * SocketServer v11.66 * PROFINET v3.4.10 * PROFINET/Modbus v1.0.8 * EtherNet/IP v7.23 * EIP/Modbus v1.09 * Modbus Router v7.10 * Modbus Server v7.12 * Modbus TCP v7.12
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan