CVSS: 7.1EPSS: 0%CPEs: 58EXPL: 0CVE-2024-38502 – Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows stored XSS
https://notcve.org/view.php?id=CVE-2024-38502
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once. • https://cert.vde.com/en/advisories/VDE-2024-033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 58EXPL: 0CVE-2024-38501 – Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
https://notcve.org/view.php?id=CVE-2024-38501
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device. • https://cert.vde.com/en/advisories/VDE-2024-033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 58EXPL: 0CVE-2024-5849 – Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS
https://notcve.org/view.php?id=CVE-2024-5849
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once. • https://cert.vde.com/en/advisories/VDE-2024-033 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6422 – Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access
https://notcve.org/view.php?id=CVE-2024-6422
An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data. Un atacante remoto no autenticado puede manipular el dispositivo a través de Telnet, detener procesos, leer, eliminar y cambiar datos. • https://cert.vde.com/en/advisories/VDE-2024-038 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6421 – Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products
https://notcve.org/view.php?id=CVE-2024-6421
An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service. Un atacante remoto no autenticado puede leer información confidencial del dispositivo a través de un servicio FTP configurado incorrectamente. • https://cert.vde.com/en/advisories/VDE-2024-038 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •