CVE-2024-38501

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Pepperl+FuchsICDM-RX/TCP-DB9/RJ45-DIN>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-ST/RJ45-DIN>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-4DB9/2RJ45-DIN>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-DB9/RJ45-PM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-2DB9/RJ45-DIN>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-2ST/RJ45-DIN>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-4DB9/2RJ45-PM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-8DB9/2RJ45-PM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-16RJ45/RJ45-RM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-16DB9/RJ45-RM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-32RJ45/RJ45-RM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-DB9/RJ45-PM2>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/TCP-16RJ45/2RJ45-PM>= SocketServer, <= 11.65
Pepperl+FuchsICDM-RX/PN-DB9/RJ45-DIN>= PROFINET, <= v3.4.9
Pepperl+FuchsICDM-RX/PN-ST/RJ45-DIN>= PROFINET, <= v3.4.9
Pepperl+FuchsICDM-RX/PN-4DB9/2RJ45-DIN>= PROFINET, <= v3.4.9
Pepperl+FuchsICDM-RX/PN-DB9/RJ45-PM>= PROFINET, <= v3.4.9
Pepperl+FuchsICDM-RX/PN-2DB9/RJ45-DIN>= PROFINET, <= v3.4.9
Pepperl+FuchsICDM-RX/PN-2ST/RJ45-DIN>= PROFINET, <= v3.4.9
Pepperl+FuchsICDM-RX/PN1-DB9/RJ45-PM>= PROFINET/Modbus, <= v1.0.7
Pepperl+FuchsICDM-RX/PN1-DB9/RJ45-DIN>= PROFINET/Modbus, <= v1.0.7
Pepperl+FuchsICDM-RX/PN1-ST/RJ45-DIN>= PROFINET/Modbus, <= v1.0.7
Pepperl+FuchsICDM-RX/PN1-2DB9/RJ45-DIN>= PROFINET/Modbus, <= v1.0.7
Pepperl+FuchsICDM-RX/PN1-4DB9/2RJ45-DIN>= PROFINET/Modbus, <= v1.0.7
Pepperl+FuchsICDM-RX/PN1-2ST/RJ45-DIN>= PROFINET/Modbus, <= v1.0.7
Pepperl+FuchsICDM-RX/EN-DB9/RJ45-DIN>= EtherNet/IP, <= v7.22
Pepperl+FuchsICDM-RX/EN-ST/RJ45-DIN>= EtherNet/IP, <= v7.22
Pepperl+FuchsICDM-RX/EN-4DB9/2RJ45-DIN>= EtherNet/IP, <= v7.22
Pepperl+FuchsICDM-RX/EN-DB9/RJ45-PM>= EtherNet/IP, <= v7.22
Pepperl+FuchsICDM-RX/EN-2DB9/RJ45-DIN>= EtherNet/IP, <= v7.22
Pepperl+FuchsICDM-RX/EN-2ST/RJ45-DIN>= EtherNet/IP, <= v7.22
Pepperl+FuchsICDM-RX/EN1-DB9/RJ45-PM>= EIP/Modbus, <= v1.08
Pepperl+FuchsICDM-RX/EN1-DB9/RJ45-DIN>= EIP/Modbus, <= v1.08
Pepperl+FuchsICDM-RX/EN1-ST/RJ45-DIN>= EIP/Modbus, <= v1.08
Pepperl+FuchsICDM-RX/EN1-2DB9/RJ45-DIN>= EIP/Modbus, <= v1.08
Pepperl+FuchsICDM-RX/EN1-4DB9/2RJ45-DIN>= EIP/Modbus, <= v1.08
Pepperl+FuchsICDM-RX/EN1-2ST/RJ45-DIN>= EIP/Modbus, <= v1.08
Pepperl+FuchsICDM-RX/MOD-DB9/RJ45-DIN>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11
Pepperl+FuchsICDM-RX/MOD-ST/RJ45-DIN>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11
Pepperl+FuchsICDM-RX/MOD-4DB9/2RJ45-DIN>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11
Pepperl+FuchsICDM-RX/MOD-DB9/RJ45-PM>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11
Pepperl+FuchsICDM-RX/MOD-2DB9/RJ45-DIN>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11
Pepperl+FuchsICDM-RX/MOD-2ST/RJ45-DIN>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11
Pepperl+FuchsICDM-RX/MOD-16RJ45/2RJ45-PM>= Modbus Router, <= v7.09; >= Modbus Server, <= v7.11; >= Modbus TCP, <= v7.11

References

Timeline

Published
Aug 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-385027.1An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-385035.4When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential explCVE-2024-385045.3In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesCVE-2024-385057.5In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteCVE-2024-385068.1In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsCVE-2024-385075.4In JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleCVE-2024-385087.2A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an aCVE-2024-385097.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arCVE-2024-38515.4A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploadsCVE-2024-385107.2A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wiCVE-2024-385117.2A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user CVE-2024-385127.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform co
CVE-2024-38501: Medium severity, CVSS 6.1 | Vulnix