Share: Email | Twitter




2021-10-26 15:35 (CEST)

Last update

2022-01-17 16:16 (CET)


Pepperl+Fuchs SE


Article No° Product Name Affected Version(s)
ABB Project Builder <=
ADM Project Builder Emerson in Emerson Integration Package <=
All contained DTMs in Diagnostic Manager <=
All contained DTMs in DTM Collection HART-Multiplexer <=
All contained DTMs in DTM Collection Level Control Technology used with Level Radar LCR20, LTC50, LTC51, LRC57 <= 1.0.31
All contained DTMs in DTM Collection WirelessHART <=
All contained DTMs in DTM Library HART used with 6500 Series <=
All contained DTMs in FieldConnex Diagnostic Gateway FF DTM <=
All contained DTMs in HART DTM Library Enhanced used with PS3500-DM <=
All contained DTMs in TMI-FF DTM <=
AMS Alert Adapter in Emerson Integration Package <=
FDH-1 Manager <=
P+F DTMLibrary Modbus in DTM used with S1SD-1TI-1U = V2.3.68
VisuNet Control Center <= 4.7.1
VisuNet Factory Reset = 5.x
VisuNet Factory Reset <= 6.1.0
VisuNet GXP PC Service Tool <= 1.1.0
VisuNet RM Shell <= 5.5.0


Critical vulnerabilities have been discovered in the utilized component log4net by Apache Software Foundation.
UPDATE A: Remediation: added fixed VisuNet Products 

Last Update:

24. November 2021 09:50


Improper Restriction of XML External Entity Reference  (CWE-611) 


Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.


Pepperl+Fuchs analyzed and identified affected devices.
In table “Affected products” packages are listed next to some products, this means that the products are only affected if the corresponding software is installed since the package implements the vulnerability.

To exploit the vulnerability, the access rights of an authorized user or admin are required. 

The impact of the vulnerability on the affected products may result in

  • Denial of Service
  • Loss of Credentials
  • Code Execution

The CVSS environmental score is specific to the customer's environment and should therefore be individually assessed by the customer to accomplish final scoring.

The original CVE refers to a network access scenario. With our products, it is a local access scenario. For this reason, the risk of exploiting this vulnerability is reduced.



External countermeasures are needed for the remaining products.
The following protective measure is required for VisuNet devices and the PCs/Servers with an installed DTM:

  • Restrict local access to the device, PC/Server and use user authentication to prevent unauthorized access.


The following affected DTM products can be updated to the listed version:

Item Version
FieldConnex DTM Collection
Diagnostic Manager
FieldConnex Diagnostic Gateway FF DTM
FDH-1 Manager
ABB Project Builder
Honeywell Integration Package
Emerson Integration Package
[ADM Project Builder Emerson]
Emerson Integration Package [AMS Alert Adapter]
DTM Collection HART-Multiplexer


The following affected VisuNet products can be updated to the listed version:

Item Version
VisuNet RM Shell 5 (2016 LTSB)
VisuNet RM Shell 5 (2019 LTSC)
VisuNet Factory Reset
VisuNet Control Center
VisuNet GXP PC Service Tool 1.1.1


Reported by

CodeWrights GmbH reported this vulnerability to PEPPERL+FUCHS.
CERT@VDE coordinated with PEPPERL+FUCHS.