Endress+Hauser: Multiple products are vulnerable to code injection
Echo Curve Viewer is an utility used for offline visualization of previously recorded envelope curve data. Envelope curve records are exported from other Endress+Hauser software products like FieldCare as .curves files. Echo Curve Viewer opens .curves files and displays their contents. The .curves files contain device- specific C# calculation scripts as .cs files, that are needed for the interpretation of certain curve record types. Echo Curve Viewer loads .curves files and executes the contained C# code.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-6596US | — | — | ||
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context. | ||||
references
External citations — patches, advisories, analysis.
remediations (1)
- Fixed
- For standalone Echo Curve Viewer installations, download and install Echo Curve Viewer version >=6.00.00 from the Endress+Hauser Software Portal - For bundled installations with FieldCare SFE500, download and install FieldCare SFE500 Package version >= 1.40.1 from the Endress+Hauser Software Portal external link - For Field Xpert Devices, the required update is installed automatically during startup. This requires a working internet connection and (under certain circumstances) a valid maintenance period and/or a connection to the E+H Netilion Cloud. Please refer to the Field Xpert documentation for details regarding the update mechanism.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan