CVE-2024-38501
Medium
Description
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
SeverityMedium
CVSS6.1
Exploit probability—
ProductPepperl-fuchs Icdm-rx\/tcp Socketserver Firmware
PublishedAug 13, 2024
First seenAug 13, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- pepperl-fuchs icdm-rx\/tcp_socketserver_firmware11.65 or later
- pepperl-fuchs profinet_firmware3.4.9 or later
- pepperl-fuchs profinet\/modbus_firmware1.0.7 or later
- pepperl-fuchs modbus_router_firmware7.09 or later
- pepperl-fuchs modbus_server_firmware7.11 or later
- pepperl-fuchs modbus_tcp_firmware7.11 or later
- pepperl-fuchs ethernet\/ip_firmware7.22 or later
- pepperl-fuchs eip\/modbus_firmware1.08 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pepperl-fuchs icdm-rx\/tcp_socketserver_firmware | v < 11.65 | 11.65 |
| pepperl-fuchs profinet_firmware | v < 3.4.9 | 3.4.9 |
| pepperl-fuchs profinet\/modbus_firmware | v < 1.0.7 | 1.0.7 |
| pepperl-fuchs modbus_router_firmware | v < 7.09 | 7.09 |
| pepperl-fuchs modbus_server_firmware | v < 7.11 | 7.11 |
| pepperl-fuchs modbus_tcp_firmware | v < 7.11 | 7.11 |
| pepperl-fuchs ethernet\/ip_firmware | v < 7.22 | 7.22 |
| pepperl-fuchs eip\/modbus_firmware | v < 1.08 | 1.08 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.