PT-2025-35545 · Endress+Hauser · Promag 10

Published 2025-09-02 · Updated 2025-09-07 · CVE-2025-41690

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Endress+Hauser Promag 10 versions (affected versions not specified)

Description A low-privileged attacker within Bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This could allow the Operator to authenticate as the Maintenance user, gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.

Recommendations Restrict Bluetooth access. Audit event logs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-41690

Affected Products

Promag 10

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-41690 · Security Note
• https://twitter.com/VulmonFeeds/status/1962796061606416485 · Twitter Post
• https://twitter.com/offseq/status/1962802971256742000 · Twitter Post
• https://t.me/CVEtracker/31485 · Telegram Post
• https://certvde.com/en/advisories/VDE-2025-068 · Note
• https://twitter.com/cracbot/status/1964644868820508747 · Twitter Post
• https://twitter.com/CVEnew/status/1962799407746662434 · Twitter Post