Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions

Impact
Successful exploitation of this vulnerability may allow an attacker to perform vertical privilege escalation, gaining unauthorized access to Maintenance-level functions. As a result, the attacker could:
• Modify all Maintenance parameters
• Change device settings
• Initiate a device reset, potentially causing operational downtime
• Restore the device to its factory default settings
• Reconfigure non-critical diagnostic parameters
• Disable Bluetooth communication
• Alter the 4–20 mA analog output range

Mitigation
If an immediate firmware update is not feasible, it is recommended to disable the device's Bluetooth communication when not actively in use. This significantly reduces the risk of unauthorized access by eliminating the key vector through which the vulnerability could be exploited.

Remediation
Endress+Hauser has released updated firmware versions for the affected devices that resolve this vulnerability. Customers are encouraged to update their devices to the latest firmware version as soon as possible.
For assistance with the update process, please contact your local Endress+Hauser service center.