| Article No° | Product Name | Affected Version(s) |
|---|---|---|
| Promag 10 with HART | < 01.00.06 | |
| Promag 10 with IO-Link | < 01.00.02 | |
| Promag 10 with Modbus | < 01.00.06 | |
| Promass 10 with HART | < 01.00.06 | |
| Promass 10 with IO-Link | < 01.00.02 | |
| Promass 10 with Modbus | < 01.00.06 |
A privilege escalation vulnerability has been identified in Endress+Hauser's Proline 10 devices. This flaw allows an authenticated user with Operator-level access to elevate their privileges and gain Maintenance-level access, potentially enabling unauthorized configuration changes.
Endress+Hauser has released a security update addressing this issue.
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
Successful exploitation of this vulnerability may allow an attacker to perform vertical privilege escalation, gaining unauthorized access to Maintenance-level functions. As a result, the attacker could:
• Modify all Maintenance parameters
• Change device settings
• Initiate a device reset, potentially causing operational downtime
• Restore the device to its factory default settings
• Reconfigure non-critical diagnostic parameters
• Disable Bluetooth communication
• Alter the 4–20 mA analog output range
Mitigation
If an immediate firmware update is not feasible, it is recommended to disable the device's Bluetooth communication when not actively in use. This significantly reduces the risk of unauthorized access by eliminating the key vector through which the vulnerability could be exploited.
Remediation
Endress+Hauser has released updated firmware versions for the affected devices that resolve this vulnerability. Customers are encouraged to update their devices to the latest firmware version as soon as possible. For assistance with the update process, please contact your local Endress+Hauser service center.
CERT@VDE coordinated with Endress+Hauser