Loading vulnerabilities…
Loading vulnerabilities…
CVE-2020-12502
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.
This record: live connection— last retrieved: 7 November 2026 at 03:37.
Vendor
Published
15 October 2020
Last modified
17 June 2026
Taken directly from NVD, CISA or the vendor — sometimes in English, unchanged from the source.
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below is prone to unauthenticated device administration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
NETWORK
Privileges required
NONE
User interaction
REQUIRED
Confidentiality
High
Integrity
High
Availability
High
Probability of exploitation within 30 days
1.0%
Percentile
64e
Source: FIRST.org, updated on 6 November 2026.
For vulnerability CVE-2020-12502 'Cross-Site Request Forgery (CSRF)', CVE-2020- 12503 'Multiple Authenticated Command Injections' and CVE-2020-12504 'Active TFTP- Service' 1. Update following products to the respective Firmware Version: | Product ID | Firmware Version | |------------------------------|-------------------| | ICRL-M-8RJ45/4SFP-G-DIN | 1.4.0 | | ICRL-M-16RJ45/4CP-G-DIN | 1.4.0 | 2. Deactivate TFTP-Service
Our own interpretation and context for the source data above.
IACS Radar assessment
Our own interpretation and context for this vulnerability — not an official source.
IACS Radar priority score
Based on CVSS 8.8, EPSS 1.0%, industrial relevance 40/100.
Combines CVSS, EPSS, KEV status, industrial relevance and exposure relevance — a complement to, not a replacement for, the individual scores below and above.
Conditions for exploitation
Operational impact & energy relevance
Possible loss of visibility of or control over the process upon successful exploitation.
No strong energy-sector-specific signals recognised; general OT/ICS relevance.
Recommended defensive measures
Industrial relevance score
Classification is provisional; manual verification by an OT security analyst is recommended.
Classified by IACS Radar-analysepijplijn (geautomatiseerd) on 7 November 2026.
IEC 62443 mapping
Automatic IACS Radar assessment based on the reported CWE weakness classification; not an official certification statement.