PT-2020-13142 · Endress+Hauser · Ecograph T

Maxim Rupp · Published 2020-11-19 · Updated 2020-12-08 · CVE-2020-12495

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) versions prior to V2.0.0

Description The affected device has a web-based user interface with a role-based access system, where users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The issue arises because user sessions are not closed correctly, allowing a user with fewer rights to be assigned higher rights when they log on.

Recommendations For versions prior to V2.0.0, update the firmware to version V2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web-based user interface or implementing additional authentication measures to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-12495

Affected Products

Ecograph T

References · 4

• https://osv.dev/vulnerability/CVE-2020-12495 · Vendor Advisory
• https://cert.vde.com/en-us/advisories/vde-2020-021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12495 · Security Note
• https://t.me/cibsecurity/16612 · Telegram Post