CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2025-41655 – PEPPERL+FUCHS: Attacker can cause a DoS via URL
https://notcve.org/view.php?id=CVE-2025-41655
26 May 2025 — An unauthenticated remote attacker can access a URL which causes the device to reboot. Un atacante remoto no autenticado puede acceder a una URL que provoca que el dispositivo se reinicie. • https://certvde.com/en/advisories/VDE-2025-011 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-41654 – PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol
https://notcve.org/view.php?id=CVE-2025-41654
26 May 2025 — An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog. Un atacante remoto no autenticado puede acceder a información sobre los procesos en ejecución mediante el protocolo SNMP. La cantidad de datos devueltos puede provocar un reinicio del sistema por parte del watchdog. • https://cert.vde.com/en/advisories/VDE-2025-011 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2025-1985 – PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by XSS vulnerability
https://notcve.org/view.php?id=CVE-2025-1985
26 May 2025 — Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device. Debido a la neutralización incorrecta de la entrada durante la generación de páginas web (XSS), un atacante remoto no autenticado puede inyectar código HTML en la interfaz de usuario web del dispositivo afectado. • https://cert.vde.com/en/advisories/VDE-2025-011 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 58EXPL: 0CVE-2024-38502 – Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows stored XSS
https://notcve.org/view.php?id=CVE-2024-38502
13 Aug 2024 — An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. • https://cert.vde.com/en/advisories/VDE-2024-033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 58EXPL: 0CVE-2024-38501 – Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
https://notcve.org/view.php?id=CVE-2024-38501
13 Aug 2024 — An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. • https://cert.vde.com/en/advisories/VDE-2024-033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 58EXPL: 0CVE-2024-5849 – Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS
https://notcve.org/view.php?id=CVE-2024-5849
13 Aug 2024 — An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once. • https://cert.vde.com/en/advisories/VDE-2024-033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6422 – Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access
https://notcve.org/view.php?id=CVE-2024-6422
10 Jul 2024 — An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. Un atacante remoto no autenticado puede manipular el dispositivo a través de Telnet, detener procesos, leer, eliminar y cambiar datos. • https://cert.vde.com/en/advisories/VDE-2024-038 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6421 – Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products
https://notcve.org/view.php?id=CVE-2024-6421
10 Jul 2024 — An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. Un atacante remoto no autenticado puede leer información confidencial del dispositivo a través de un servicio FTP configurado incorrectamente. • https://cert.vde.com/en/advisories/VDE-2024-038 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-34565 – In WirelessHART-Gateway versions 3.0.7 to 3.0.9 hard-coded credentials have been found
https://notcve.org/view.php?id=CVE-2021-34565
31 Aug 2021 — In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. En PEPPERL+FUCHS WirelessHART-Gateway versiones 3.0.7 hasta 3.0.9, los servicios SSH y telnet están activos con credenciales embebidas • https://cert.vde.com/en-us/advisories/vde-2021-027 • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-34564 – In WirelessHART-Gateway versions 3.0.9 a vulnerability allows to read and write sensitive data in a cookie
https://notcve.org/view.php?id=CVE-2021-34564
31 Aug 2021 — Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9. Cualquier vulnerabilidad de robo de cookies dentro de la aplicación o el navegador permitiría a un atacante robar las credenciales del usuario al PEPPERL+FUCHS WirelessHART-Gateway versión 3.0.9 • https://cert.vde.com/en-us/advisories/vde-2021-027 • CWE-315: Cleartext Storage of Sensitive Information in a Cookie •