Description
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Endress+Hauser | Echo Curve Viewer | ≤ 5.2.2.6 | — |
| Endress+Hauser | FieldCare SFE500 Package USB | ≤ V1.40.00.7448 | — |
| Endress+Hauser | FieldCare SFE500 Package Web-Package | ≤ V1.40.00.7448 | — |
| Endress+Hauser | Field Xpert SMT50 | ≤ SMT50_Win10_LTSC_21H2_v1.07.00_RC02_03 | — |
| Endress+Hauser | Field Xpert SMT70 | ≤ SMT70_Win10_LTSC_21H2_v1.07.00_RC02_01 | — |
| Endress+Hauser | Field Xpert SMT77 | ≤ SMT77_Win10_SAC_22H2_v1.08.04_RC03_02 | — |
| Endress+Hauser | Field Xpert SMT79 | ≤ V1.08.02-1.8.8684.34292 | — |
Advisories 1
- VDE-2024-041 Endress+Hauser: Multiple products are vulnerable to code injection CERT@VDE · Sep 10, 2024