CVE-2020-12501 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Attackers can gain unauthorized access to Pepperl+Fuchs RocketLinx switches using undocumented accounts, leading to potential device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12501?
CVE-2020-12501 is a critical vulnerability in Korenix JetNet, published on 15 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
Weakness: CWE-798
Which versions are affected by CVE-2020-12501?
It affects 26 products.
Products include Korenix Jetnet4510 Firmware, Korenix Jetnet4706 Firmware, Korenix Jetnet4706f Firmware, Korenix Jetnet5010 Firmware, Korenix Jetnet5310 Firmware, Korenix Jetnet5428g-20sfp Firmware and 20 more.
How do I fix CVE-2020-12501?
No fix has been published for CVE-2020-12501 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-12501 being exploited?
There is no known exploitation of CVE-2020-12501 in the wild and no public exploit code.
Sources
Also known as GHSA-xfr3-v749-v2r3.