CVE-2020-12495

ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management

State: Published
Severity: 9.1 Critical
Published: Nov 19, 2020
Updated: Sep 16, 2024
Reserved: Apr 30, 2020

Description

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The vulnerability is that user sessions are not closed correctly and a user with fewer rights is assigned the higher rights when he logs on.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	CERTVDE

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
RSG35 - Ecograph TEndress+Hauser	V1.0.0 to before V2.0.0Affected
ORSG35 - Ecograph T Neutral/Private LabelEndress+Hauser	V1.0.0 to before V2.0.0Affected

References

https://cert.vde.com/en-us/advisories/vde-2020-021

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.