Endress+Hauser: products utilizing WPA2 vulnerable to KRACK attacks

Impact
The feasibility of modifying the configuration of the device depends on the configuration settings regarding the used protocol (for example: OPC UA, http) to communicate via WLAN.

- Access to operator network via device isn't possible because bridging in the device isn't supported.
- The WLAN passphrase isn't readable.
- Via OPC UA: read/write data access isn't possible if encryption is activated.
- Via Webserver and CDI-RJ45: read data is possible. Write data isn't possible if individual password is used.

Mitigation
If an immediate firmware update is not possible, the WLAN on the unit can also be switched off as a precautionary measure.

Recommendations
As a general security measure Endress+Hauser strongly recommends protecting network access to the WLAN network with appropriate mechanisms. It is advised to configure the environment according to best practices to run the devices in a protected IT environment. Further general recommendations apply for the affected products:

Activate encryption for OPC UA
For Webserver and CDI-RJ45: Change device default password to individual password
For WLAN: Change WLAN default password to individual WLAN password

Remediation
Endress+Hauser provides updated firmware versions for all related products from the Proline portfolio which fixes the vulnerability and recommends customers to update to the new fixed version. For support, please contact your local service center.