CVE-2024-5849

Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS

High7.1EPSS 0.38%

Published: 13 Aug 2024
Updated: 15 Aug 2024
Reserved: 11 Jun 2024
Assigned by: CERTVDE

Description

An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.

Timeline

2024
11 Jun 2024
11 Jun 2024
ID reserved
By CERTVDE
13 Aug 20242 months later
13 Aug 2024· 2 months later
Published
15 Aug 20242 days later
15 Aug 2024· 2 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-5849, by who scored it
Scored by	CVSS	Score	Vector
CERTVDECNA (assigner)	3.1	High7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVDNVD · Analyzed	3.1	High7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS (exploitation in 30 days): 0.38% · top 68% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Pepperl+Fuchs · ICDM-RX/TCP-DB9/RJ45-DIN
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-ST/RJ45-DIN
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-4DB9/2RJ45-DIN
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-DB9/RJ45-PM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-2DB9/RJ45-DIN
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-2ST/RJ45-DIN
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-4DB9/2RJ45-PM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-8DB9/2RJ45-PM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-16RJ45/RJ45-RM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-16DB9/RJ45-RM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-32RJ45/RJ45-RM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-DB9/RJ45-PM2
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/TCP-16RJ45/2RJ45-PM
- affected SocketServer – ≤ 11.65
Pepperl+Fuchs · ICDM-RX/PN-DB9/RJ45-DIN
- affected PROFINET – ≤ v3.4.9
Pepperl+Fuchs · ICDM-RX/PN-ST/RJ45-DIN
- affected PROFINET – ≤ v3.4.9
Pepperl+Fuchs · ICDM-RX/PN-4DB9/2RJ45-DIN
- affected PROFINET – ≤ v3.4.9
Pepperl+Fuchs · ICDM-RX/PN-DB9/RJ45-PM
- affected PROFINET – ≤ v3.4.9
Pepperl+Fuchs · ICDM-RX/PN-2DB9/RJ45-DIN
- affected PROFINET – ≤ v3.4.9
Pepperl+Fuchs · ICDM-RX/PN-2ST/RJ45-DIN
- affected PROFINET – ≤ v3.4.9
Pepperl+Fuchs · ICDM-RX/PN1-DB9/RJ45-PM
- affected PROFINET/Modbus – ≤ v1.0.7
Pepperl+Fuchs · ICDM-RX/PN1-DB9/RJ45-DIN
- affected PROFINET/Modbus – ≤ v1.0.7
Pepperl+Fuchs · ICDM-RX/PN1-ST/RJ45-DIN
- affected PROFINET/Modbus – ≤ v1.0.7
Pepperl+Fuchs · ICDM-RX/PN1-2DB9/RJ45-DIN
- affected PROFINET/Modbus – ≤ v1.0.7
Pepperl+Fuchs · ICDM-RX/PN1-4DB9/2RJ45-DIN
- affected PROFINET/Modbus – ≤ v1.0.7
Pepperl+Fuchs · ICDM-RX/PN1-2ST/RJ45-DIN
- affected PROFINET/Modbus – ≤ v1.0.7
Pepperl+Fuchs · ICDM-RX/EN-DB9/RJ45-DIN
- affected EtherNet/IP – ≤ v7.22
Pepperl+Fuchs · ICDM-RX/EN-ST/RJ45-DIN
- affected EtherNet/IP – ≤ v7.22
Pepperl+Fuchs · ICDM-RX/EN-4DB9/2RJ45-DIN
- affected EtherNet/IP – ≤ v7.22
Pepperl+Fuchs · ICDM-RX/EN-DB9/RJ45-PM
- affected EtherNet/IP – ≤ v7.22
Pepperl+Fuchs · ICDM-RX/EN-2DB9/RJ45-DIN
- affected EtherNet/IP – ≤ v7.22
Pepperl+Fuchs · ICDM-RX/EN-2ST/RJ45-DIN
- affected EtherNet/IP – ≤ v7.22
Pepperl+Fuchs · ICDM-RX/EN1-DB9/RJ45-PM
- affected EIP/Modbus – ≤ v1.08
Pepperl+Fuchs · ICDM-RX/EN1-DB9/RJ45-DIN
- affected EIP/Modbus – ≤ v1.08
Pepperl+Fuchs · ICDM-RX/EN1-ST/RJ45-DIN
- affected EIP/Modbus – ≤ v1.08
Pepperl+Fuchs · ICDM-RX/EN1-2DB9/RJ45-DIN
- affected EIP/Modbus – ≤ v1.08
Pepperl+Fuchs · ICDM-RX/EN1-4DB9/2RJ45-DIN
- affected EIP/Modbus – ≤ v1.08
Pepperl+Fuchs · ICDM-RX/EN1-2ST/RJ45-DIN
- affected EIP/Modbus – ≤ v1.08
Pepperl+Fuchs · ICDM-RX/MOD-DB9/RJ45-DIN
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11
Pepperl+Fuchs · ICDM-RX/MOD-ST/RJ45-DIN
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11
Pepperl+Fuchs · ICDM-RX/MOD-4DB9/2RJ45-DIN
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11
Pepperl+Fuchs · ICDM-RX/MOD-DB9/RJ45-PM
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11
Pepperl+Fuchs · ICDM-RX/MOD-2DB9/RJ45-DIN
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11
Pepperl+Fuchs · ICDM-RX/MOD-2ST/RJ45-DIN
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11
Pepperl+Fuchs · ICDM-RX/MOD-16RJ45/2RJ45-PM
- affected Modbus Router – ≤ v7.09
- affected Modbus Server – ≤ v7.11
- affected Modbus TCP – ≤ v7.11

References (1)

https://cert.vde.com/en/advisories/VDE-2024-033 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-5849](https://trackcve.app/badge/CVE-2024-5849.svg)](https://trackcve.app/cve/CVE-2024-5849)

Record last updated 15 Aug 2024, 14:14 UTC.