CVE-2024-5849
High
Description
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
SeverityHigh
CVSS7.1
Exploit probability—
ProductPepperl-fuchs Icdm-rx\/tcp Socketserver Firmware
PublishedAug 13, 2024
First seenAug 13, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- pepperl-fuchs icdm-rx\/tcp_socketserver_firmware11.65 or later
- pepperl-fuchs profinet_firmware3.4.9 or later
- pepperl-fuchs profinet\/modbus_firmware1.0.7 or later
- pepperl-fuchs modbus_router_firmware7.09 or later
- pepperl-fuchs modbus_server_firmware7.11 or later
- pepperl-fuchs modbus_tcp_firmware7.11 or later
- pepperl-fuchs ethernet\/ip_firmware7.22 or later
- pepperl-fuchs eip\/modbus_firmware1.08 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pepperl-fuchs icdm-rx\/tcp_socketserver_firmware | v < 11.65 | 11.65 |
| pepperl-fuchs profinet_firmware | v < 3.4.9 | 3.4.9 |
| pepperl-fuchs profinet\/modbus_firmware | v < 1.0.7 | 1.0.7 |
| pepperl-fuchs modbus_router_firmware | v < 7.09 | 7.09 |
| pepperl-fuchs modbus_server_firmware | v < 7.11 | 7.11 |
| pepperl-fuchs modbus_tcp_firmware | v < 7.11 | 7.11 |
| pepperl-fuchs ethernet\/ip_firmware | v < 7.22 | 7.22 |
| pepperl-fuchs eip\/modbus_firmware | v < 1.08 | 1.08 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.