CVE-2024-6596

🗓️ 10 Sep 2024 08:01:26Reported by CERTVDEType

Unauthenticated remote attacker can run malicious c# code from curve file

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2024-6596	10 Sep 202410:52	–	circl
CNNVD	Endress+Hauser Echo Curve Viewer 代码注入漏洞	10 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-6596 Endress+Hauser: Multiple products are vulnerable to code injection	10 Sep 202408:01	–	cvelist
EUVD	EUVD-2024-47661	3 Oct 202520:07	–	euvd
NVD	CVE-2024-6596	10 Sep 202408:15	–	nvd
Positive Technologies	PT-2024-37745 · Endress+Hauser · Fieldcare +1	10 Sep 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-6596	5 Feb 202502:56	–	redhatcve
Vulnrichment	CVE-2024-6596 Endress+Hauser: Multiple products are vulnerable to code injection	10 Sep 202408:01	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

endress echo_curve_viewerRange<6.0.0

endress fieldcare_sfe500_packageRange<1.40.1

Node

endress field_xpert_smt79_firmwareMatch-

AND

endress field_xpert_smt79Match-

Node

endress field_xpert_smt77_firmwareMatch-

AND

endress field_xpert_smt77Match-

Node

endress field_xpert_smt70_firmwareMatch-

AND

endress field_xpert_smt70Match-

Node

endress field_xpert_smt50_firmwareMatch-

AND

endress field_xpert_smt50Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "Echo Curve Viewer",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "5.2.2.6",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "FieldCare SFE500 Package USB",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "V1.40.00.7448",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "FieldCare SFE500 Package Web-Package",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "V1.40.00.7448",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Field Xpert SMT50",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "SMT50_Win10_LTSC_21H2_v1.07.00_RC02_03",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Field Xpert SMT70",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "SMT70_Win10_LTSC_21H2_v1.07.00_RC02_01",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Field Xpert SMT77",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "SMT77_Win10_SAC_22H2_v1.08.04_RC03_02",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Field Xpert SMT79",
    "vendor": "Endress+Hauser",
    "versions": [
      {
        "lessThanOrEqual": "V1.08.02-1.8.8684.34292",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
cert	www.cert.vde.com/en/advisories/VDE-2024-041

01 Oct 2024 12:26Current

9.9High risk

Vulners AI Score9.9

CVSS 3.19.8

EPSS0.00749

SSVC

CWE-94