Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-32463US | high7.8OT kritisch | KEV | ||
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2026-032: Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW - HTMLself
- CERT@VDE Security Advisories for Endress+Hauserexternal
- VDE-2026-032: Endress+Hauser: Sudo vulnerability affects Endress+Hauser MCS200HW - CSAFself
- Endress+Hauserexternal
- Standalone display firmware, update procedure and further detailsexternal
Behebungen (2)
- MitigationEndress+Hauser MCS200HW with firmware <1.11.5.6R
As a temporary mitigation measure, both system and network access to the affected functionality should be strictly restricted. Access should be limited to authorized personnel only, and exposure to external or untrusted networks should be minimized or fully blocked until an update of the display firmware has been completed.
- BehobenEndress+Hauser MCS200HW with firmware <1.11.5.6R
The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan