by Kastro CVE-2024-6596
Endress+Hauser Echo Curve Viewer — Endress+Hauser: Multiple products are vulnerable to code injection
Description · from the CVE record
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
Affected
ProductAffectedFixed inSource
Echo Curve Viewer≤ 5.2.2.6–CNA
FieldCare SFE500 Package USB≤ V1.40.00.7448–CNA
FieldCare SFE500 Package Web-Package≤ V1.40.00.7448–CNA
Field Xpert SMT50≤ SMT50_Win10_LTSC_21H2_v1.07.00_RC02_03–CNA
Field Xpert SMT70≤ SMT70_Win10_LTSC_21H2_v1.07.00_RC02_01–CNA
Field Xpert SMT77≤ SMT77_Win10_SAC_22H2_v1.08.04_RC03_02–CNA
Field Xpert SMT79≤ V1.08.02-1.8.8684.34292–CNA
echo_curve_viewer_firmware≤ 5.2.2.6–CISA-ADP
fieldcare_sfe500_package_usb_firmware≤ 1.40.00.7448–CISA-ADP
fieldcare_sfe500_package_web-package_firmware≤ 1.40.00.7448–CISA-ADP
field_xpert_smt70_firmware≤ SMT70_Win10_LTSC_21H2_v1.07.00_RC02_01–CISA-ADP
field_xpert_smt50_firmware≤ SMT50_Win10_LTSC_21H2_v1.07.00_RC02_03–CISA-ADP
Scores by source
CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total