Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions
A privilege escalation vulnerability has been identified in Endress+Hauser's Proline 10 devices. This flaw allows an authenticated user with Operator-level access to elevate their privileges and gain Maintenance-level access, potentially enabling unauthorized configuration changes. Endress+Hauser has released a security update addressing this issue.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41690US | — | — | ||
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2025-068: Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions - HTMLself
- CERT@VDE Security Advisories for Endress+Hauserexternal
- VDE-2025-068: Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions - CSAFself
- Endress+Hauserexternal
Behebungen (2)
- Mitigation
If an immediate firmware update is not feasible, it is recommended to disable the device's Bluetooth communication when not actively in use. This significantly reduces the risk of unauthorized access by eliminating the key vector through which the vulnerability could be exploited.
- Behoben
Endress+Hauser has released a security update addressing this issue.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan