Endress+Hauser: buffer overflow in glibc ld.so leading to privilege escalation
A vulnerability has been identified in WAGO devices utilized in Endress+Hauser IoT solutions. WAGO has provided fixes for these vulnerabilities, which have been integrated into the solutions by Endress+Hauser.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-4911US | high7.8OT critical | KEV | ||
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Mitigation
Local access is required to exploit this vulnerability. To mitigate the risk, ensure that only authorized personnel have physical access to the device.
- Fixed
Endress+Hauser provides updated firmware versions for the related components from WAGO which fixes the vulnerability. Endress+Hauser strongly recommends customers to update to the new fixed version. For support, please contact your local service center.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan