CVE-2024-5849 json
Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSS
published 2024-08-13 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-46994
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
Patch / fix
- pepperl-fuchs icdm-rx/tcp_socketserver_firmware 11.65
- pepperl-fuchs profinet_firmware 3.4.9
- pepperl-fuchs profinet/modbus_firmware 1.0.7
- pepperl-fuchs modbus_router_firmware 7.09
- pepperl-fuchs modbus_server_firmware 7.11
- pepperl-fuchs modbus_tcp_firmware 7.11
- pepperl-fuchs ethernet/ip_firmware 7.22
- pepperl-fuchs eip/modbus_firmware 1.08
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Affected products
- Pepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/TCP-ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/TCP-4DB9/2RJ45-DIN
- Pepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-PM
- Pepperl+Fuchs ICDM-RX/TCP-2DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/TCP-2ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/TCP-4DB9/2RJ45-PM
- Pepperl+Fuchs ICDM-RX/TCP-8DB9/2RJ45-PM
- Pepperl+Fuchs ICDM-RX/TCP-16RJ45/RJ45-RM
- Pepperl+Fuchs ICDM-RX/TCP-16DB9/RJ45-RM
- Pepperl+Fuchs ICDM-RX/TCP-32RJ45/RJ45-RM
- Pepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-PM2
- Pepperl+Fuchs ICDM-RX/TCP-16RJ45/2RJ45-PM
- Pepperl+Fuchs ICDM-RX/PN-DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN-ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN-4DB9/2RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN-DB9/RJ45-PM
- Pepperl+Fuchs ICDM-RX/PN-2DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN-2ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN1-DB9/RJ45-PM
- Pepperl+Fuchs ICDM-RX/PN1-DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN1-ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN1-2DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN1-4DB9/2RJ45-DIN
- Pepperl+Fuchs ICDM-RX/PN1-2ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN-DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN-ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN-4DB9/2RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN-DB9/RJ45-PM
- Pepperl+Fuchs ICDM-RX/EN-2DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN-2ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN1-DB9/RJ45-PM
- Pepperl+Fuchs ICDM-RX/EN1-DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN1-ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN1-2DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN1-4DB9/2RJ45-DIN
- Pepperl+Fuchs ICDM-RX/EN1-2ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/MOD-DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/MOD-ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/MOD-4DB9/2RJ45-DIN
- Pepperl+Fuchs ICDM-RX/MOD-DB9/RJ45-PM
- Pepperl+Fuchs ICDM-RX/MOD-2DB9/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/MOD-2ST/RJ45-DIN
- Pepperl+Fuchs ICDM-RX/MOD-16RJ45/2RJ45-PM
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
cert.vde.com
/en/advisories/VDE-2024-033
third-party-advisory
Sources
- CVE List CVE-2024-5849
- NVD CVE-2024-5849
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.