Back to Database
Status published
Critical
CVE-2020-12501
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Vulnerability Description
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) use undocumented accounts.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12501
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- T. Weber (SEC Consult Vulnerability Lab)
- Coordinated by CERT@VDE
References
- https://cert.vde.com/de-de/advisories/vde-2020-040
- http://seclists.org/fulldisclosure/2021/Jun/0
- http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html
- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/
- http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html
- http://seclists.org/fulldisclosure/2022/Jun/3
- http://packetstormsecurity.com/files/167409/Korenix-JetPort-5601V3-Backdoor-Account.html
More from Pepperl+Fuchs
View All →CVE-2025-41655
PEPPERL+FUCHS: Attacker can cause a DoS via URL
High
7.5
CVE-2025-41654
PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol
High
8.2
CVE-2025-1985
PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability
Medium
6.1
CVE-2024-6422
Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access
Critical
9.8
CVE-2024-6421
Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products
High
7.5
Affected Vendor
Pepperl+Fuchs
View all reports →Affected Software
P+F Comtrol RocketLinx, JetNet, PMI-110-F2G
Vulnerable Versions:
ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT all, ES7510-XT, ES8510, 5428G-20SFP, 5810G, 4706F, 4510, 5310, unspecified
Timeline
Official Publish:
October 15th, 2020
Last Modified:
September 16th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H