# CVE-2020-12504

## Summary

- **CVE ID:** CVE-2020-12504
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-912
- **Published:** Oct 15, 2020
- **Last Modified:** Mar 14, 2026

## Description

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.

## Affected Products

- Pepperl+Fuchs — P+F Comtrol RocketLinx (ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F,  ES8510-XTE, ES9528/ES9528-XT all)
- Pepperl+Fuchs — P+F Comtrol RocketLinx (ES7510-XT)
- Pepperl+Fuchs — P+F Comtrol RocketLinx (ES8510)
- Pepperl+Fuchs — P+F Comtrol RocketLinx (ICRL-M-8RJ45/4SFP-G-DIN)
- Pepperl+Fuchs — P+F Comtrol RocketLinx (ICRL-M-16RJ45/4CP-G-DIN)
- Korenix — JetNet (5428G-20SFP)
- Korenix — JetNet (5810G)
- Korenix — JetNet (4706F)
- Korenix — JetNet (4510)
- Korenix — JetNet (5310)
- Westermo — PMI-110-F2G (unspecified)

## References

- [CNA](https://cert.vde.com/de-de/advisories/vde-2020-040)
- [CNA](http://seclists.org/fulldisclosure/2021/Jun/0)
- [CNA](http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html)
- [CNA](https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/)
- [CNA](https://cert.vde.com/en-us/advisories/vde-2020-053)
- [CNA](http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.55%
- **EPSS Percentile:** 67.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._