Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2020-12501

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

CVSS 9.8 CriticalCriticalEPSS 0.033 · 88th percentile

Critical, because:

  • CVSS score 9.8: 9.0 or more.

How we decide what’s critical

Published by the CVE Program (CNA: CERTVDE) at 15 Oct 2020, 18:42 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Pepperl+Fuchs P+F Comtrol RocketLinx
  • affected ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT all
  • affected ES7510-XT to before 2.1.1 custom
  • affected ES8510 to before 3.1.1 custom
Korenix JetNet
  • affected 5428G-20SFP to V1.0, inclusive custom
  • affected 5810G to V1.1, inclusive custom
  • affected 4706F to V2.3b, inclusive custom
  • affected 4510 to V3.0b, inclusive custom
  • affected 5310 to before V1.6 custom
Westermo PMI-110-F2G
  • affected unspecified to before V1.8 custom
Identifiers
CVE-2020-12501
CNA
CERTVDE
Weakness (CWE)
CWE-798
Tags
Published
15 Oct 2020
Updated
16 Sept 2024

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
9.8 Critical 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA (CERTVDE)
  • CISA KEV Not listed.
  • EPSS 0.033, the 88th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 15 Oct 2020. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.