Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2024-6596

Endress+Hauser: Multiple products are vulnerable to code injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERTVDE

Description

An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Endress+Hauser Echo Curve Viewer

Default version status: unaffected

  • 0 to ≤ 5.2.2.6affected

Endress+Hauser FieldCare SFE500 Package USB

Default version status: unaffected

  • 0 to ≤ V1.40.00.7448affected

Endress+Hauser FieldCare SFE500 Package Web-Package

Default version status: unaffected

  • 0 to ≤ V1.40.00.7448affected

Endress+Hauser Field Xpert SMT50

Default version status: unaffected

  • 0 to ≤ SMT50_Win10_LTSC_21H2_v1.07.00_RC02_03affected

Endress+Hauser Field Xpert SMT70

Default version status: unaffected

  • 0 to ≤ SMT70_Win10_LTSC_21H2_v1.07.00_RC02_01affected

Endress+Hauser Field Xpert SMT77

Default version status: unaffected

  • 0 to ≤ SMT77_Win10_SAC_22H2_v1.08.04_RC03_02affected

Endress+Hauser Field Xpert SMT79

Default version status: unaffected

  • 0 to ≤ V1.08.02-1.8.8684.34292affected

References