CVE-2024-6596
Critical
Description
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
SeverityCritical
CVSS9.8
Exploit probability—
ProductEndress Echo Curve Viewer
PublishedSep 10, 2024
First seenSep 10, 2024
Weakness typeCWE-94Code injection
How to fix
Update
- endress echo_curve_viewer6.0.0 or later
- endress fieldcare_sfe500_package1.40.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| endress echo_curve_viewer | v < 6.0.0 | 6.0.0 |
| endress fieldcare_sfe500_package | v < 1.40.1 | 1.40.1 |
| endress field_xpert_smt79_firmware | No range specified | — |
| endress field_xpert_smt77_firmware | No range specified | — |
| endress field_xpert_smt70_firmware | No range specified | — |
| endress field_xpert_smt50_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.