Pepperl+Fuchs: Multiple DTM and VisuNet Software affected by log4net vulnerability
Critical vulnerabilities have been discovered in the utilized component log4net by Apache Software Foundation. UPDATE A: Remediation: added fixed VisuNet Products
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-1285US | critical9.8 | Exploit | ||
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept a… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Mitigation
External countermeasures are needed for the remaining products. The following protective measure is required for VisuNet devices and the PCs/Servers with an installed DTM: Restrict local access to the device, PC/Server and use user authentication to prevent unauthorized access.
- Behoben
The following affected DTM products can be updated to the listed version: | Item | Version | |--------------------------------------------|----------------| | FieldConnex DTM Collection | 1.7.1.2159 | | Diagnostic Manager | 2.2.3.3527 | | FieldConnex Diagnostic Gateway FF DTM | 2.2.3.3527 | | FDH-1 Manager | 1.0.2.1049 | | ABB Project Builder | 1.1.2.1134 | | Honeywell Integration Package | 1.1.3.0 | | Emerson Integration Package [ADM Project Builder Emerson] | 1.1.4.1474 | | Emerson Integration Package [AMS Alert Adapter] | 1.1.3.72 | | DTM Collection HART-Multiplexer | 2.0.1.208 | UPDATE A The following affected VisuNet products can be updated to the listed version: | Item | Version | |------------------------------------------|---------------| | VisuNet RM Shell 5 (2016 LTSB) | 5.5.1.1200 | | VisuNet RM Shell 5 (2019 LTSC) | 5.6.0.1383 | | VisuNet Factory Reset | 6.1.1.262 | | VisuNet Control Center | 4.8.0.1596 | | VisuNet GXP PC Service Tool | 1.1.1 | END UPDATE A
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan