Pepperl-Fuchs
27 CVEs across 230 Pepperl-Fuchs products. Browse Pepperl-Fuchs vulnerabilities, severities, and proof-of-concept exploits.
Pepperl-Fuchs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5849 | High | 7.1 | 2024-08-13 | An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once. |
CVE-2024-38502 | High | 7.1 | 2024-08-13 | An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. |
CVE-2024-38501 | Medium | 6.1 | 2024-08-13 | An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on t… |
CVE-2024-6422 | Critical | 9.8 | 2024-07-10 | An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. |
CVE-2024-6421 | High | 7.5 | 2024-07-10 | An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. |
CVE-2021-34565 | Critical | 9.8 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. |
CVE-2021-34564 | Medium | 5.5 | 2021-08-31 | Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHAR… |
CVE-2021-34563 | Low | 3.3 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client… |
CVE-2021-34562 | Medium | 5.4 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response. |
CVE-2021-34561 | High | 7.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Atta… |
CVE-2021-34560 | Medium | 5.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacke… |
CVE-2021-34559 | Medium | 5.4 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. |
CVE-2021-33555 | High | 7.5 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrar… |
CVE-2021-20988 | High | 8.6 | 2021-05-13 | In Hilscher rcX RTOS versions prios to V2.1.14.1 the actual UDP packet length is not verified against the length indicated by the packet. This may lead to a de… |
CVE-2021-20987 | High | 8.6 | 2021-02-16 | A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through ne… |
CVE-2021-20986 | High | 7.5 | 2021-02-16 | A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic commun… |
CVE-2020-12525 | High | 7.3 | 2021-01-22 | M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its pro… |
CVE-2020-12514 | Medium | 6.6 | 2021-01-22 | Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd |
CVE-2020-12513 | High | 7.5 | 2021-01-22 | Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection. |
CVE-2020-12512 | High | 7.5 | 2021-01-22 | Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting |
CVE-2020-12511 | High | 8.8 | 2021-01-22 | Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the web interface. |
CVE-2020-12504 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12503 | High | 7.2 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12502 | High | 8.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12501 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-12500 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2017-5753 | Medium | 5.6 | 2018-01-04 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local u… |