PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability and information disclosure
A stored cross-site scripting vulnerability has been discovered in the profinet gateway LB8122A.1.EL. An attacker can write an HTML tag with up to 32 characters in the message field of a HART transmitter. The HTML tag is interpreted as HTML when the HART information is displayed in a webbrowser. If the HTML tag contains a link to a manipulated page, a user can be tricked into accessing this page. Furthermore, an attacker can access information about running processes via the SNMP protocol. Sending such SNMP read commands can also trigger a reboot.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41655US | —OT erhöht | — | ||
An unauthenticated remote attacker can access a URL which causes the device to reboot. | ||||
| CVE-2025-41654US | —OT erhöht | — | ||
An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog. | ||||
| CVE-2025-1985US | — | — | ||
Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2025-011: PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability and information disclosure - HTMLself
- CERT@VDE Security Advisories for Pepperl+Fuchsexternal
- Pepperl+Fuchs PSIRTexternal
- VDE-2025-011: PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability and information disclosure - CSAFself
Behebungen (4)
- Behoben
Please install the updated firmware V1.3.13.
- Behoben
Please install the updated firmware V1.3.13.
- BehobenFirmware V1.3.13 installed on Profinet Gateway FB8122A.1.EL
Please install the updated firmware V1.3.13.
- BehobenFirmware V1.3.13 installed on Profinet Gateway LB8122A.1.EL
Please install the updated firmware V1.3.13.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan