Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

7.2 CVSS

Vulnerability Description

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to multiple authenticated command injections.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12503

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

T. Weber (SEC Consult Vulnerability Lab)
Coordinated by CERT@VDE

References

More from Pepperl+Fuchs

View All →

CVE-2025-41655

PEPPERL+FUCHS: Attacker can cause a DoS via URL

High 7.5

CVE-2025-41654

PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol

High 8.2

CVE-2025-1985

PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability

Medium 6.1

CVE-2024-6422

Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access

Critical 9.8

CVE-2024-6421

Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products

High 7.5

Affected Vendor

Pepperl+Fuchs

View all reports →

Affected Software

P+F Comtrol RocketLinx, JetNet, PMI-110-F2G

Vulnerable Versions:

ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT all, ES7510-XT, ES8510, ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN, 5428G-20SFP, 5810G, 4706F, 4510, 5310, unspecified