Summary
Multiple vulnerabilities in a Qualcomm component have been reported in a closed-source report. This component is an integral part of the radio chip found in several Endress+Hauser products.
Impact
Due to the closed-source nature of the report, the impact remains uncertain. In the worst-case scenario, this could lead to a loss of availability, integrity, and confidentiality.
In the case of the Liquiline Edge Module EMR, integrity and confidentiality are not affected due to the system architecture. The TLS connection to the Netilion cloud is fully managed by the integrated Linux system, which ensures end-to-end encryption. The Qualcomm radio chip is only used to transmit already encrypted data over the mobile network. Nevertheless, a complete loss of availability is still possible.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| CYY7 | Endress+Hauser Liquiline Edge Module EMR | Firmware <01.02.00 |
| 5W8C | Endress+Hauser Promag W 800 | Firmware <01.00.08 |
Vulnerabilities
Expand / Collapse allMitigation
If a firmware update is no longer possible, it is recommended to replace the device.
Remediation
Endress+Hauser has released an updated firmware for the affected device that includes a security patch for the radio chip to address this vulnerability. Customers are encouraged to update their devices to the latest firmware version as soon as possible. For assistance, please contact your local Endress+Hauser service center.
Acknowledgments
Endress+Hauser AG thanks the following parties for their efforts:
- CERT@VDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 12/05/2025 12:00 | Initial version |