CVE-2020-12504 - CVE House
Back to Database
Status published Critical CVE-2020-12504

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

Vulnerability Description

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12504

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • T. Weber (SEC Consult Vulnerability Lab)
  • Coordinated by CERT@VDE

References

More from Pepperl+Fuchs

View All →
CVE-2025-41655
PEPPERL+FUCHS: Attacker can cause a DoS via URL
High 7.5
CVE-2025-41654
PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol
High 8.2
CVE-2025-1985
PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability
Medium 6.1
CVE-2024-6422
Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access
Critical 9.8
CVE-2024-6421
Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products
High 7.5

Affected Vendor

Pepperl+Fuchs

View all reports →

Affected Software

P+F Comtrol RocketLinx, JetNet, PMI-110-F2G
Vulnerable Versions:
ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT all, ES7510-XT, ES8510, ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN, 5428G-20SFP, 5810G, 4706F, 4510, 5310, unspecified

Timeline

Official Publish: October 15th, 2020
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-912

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.