Skip to content
Noroxi

endress records

23 published records for vendor endress.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 24
  4. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

23 records
  • CVE-2024-6596
    39Monitor

    Endress+Hauser: Multiple products are vulnerable to code injection

    CriticalCVSS 9.8No exploitEPSS 0%

    endress · echo curve viewerSep 10, 2024

  • CVE-2025-27456
    39Monitor

    The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short ti

    CriticalCVSS 9.8No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-1710
    39Monitor

    The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time fr

    CriticalCVSS 9.8No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27449
    39Monitor

    The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, maki

    CriticalCVSS 9.8No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2020-12495
    35Monitor

    ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management

    HighCVSS 8.8No exploitEPSS 0%

    endress · rsg35 firmwareNov 19, 2020

  • CVE-2018-16059
    30Monitor

    Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.

    MediumCVSS 5.3Proof of conceptEPSS 29%

    endress · wirelesshart fieldgate swg70 firmwareSep 7, 2018

  • CVE-2025-1708
    30Monitor

    The application is vulnerable to SQL injection attacks.

    HighCVSS 7.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27452
    30Monitor

    The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure.

    HighCVSS 7.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-1711
    30Monitor

    Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.

    HighCVSS 7.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27457
    30Monitor

    All communication between the VNC server and client(s) is unencrypted.

    HighCVSS 7.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27459
    30Monitor

    The VNC application stores its passwords encrypted within the registry but uses DES for encryption.

    HighCVSS 7.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27458
    30Monitor

    The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption.

    HighCVSS 7.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27461
    27Monitor

    During startup, the device automatically logs in the EPC2 Windows user without requesting a password.

    MediumCVSS 6.8No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27460
    27Monitor

    The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker.

    MediumCVSS 6.8No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2020-12496
    26Monitor

    ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor

    MediumCVSS 6.5No exploitEPSS 0%

    endress · rsg35 firmwareNov 19, 2020

  • CVE-2025-27453
    26Monitor

    The HttpOnly flag is set to false on the PHPSESSION cookie.

    MediumCVSS 6.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-1709
    26Monitor

    Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded).

    MediumCVSS 6.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27450
    26Monitor

    The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4.

    MediumCVSS 6.5No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27447
    24Monitor

    The web application is susceptible to cross-site-scripting attacks.

    MediumCVSS 6.1No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27455
    24Monitor

    The web application is vulnerable to clickjacking attacks.

    MediumCVSS 6.1No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27451
    21Monitor

    For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect passwo

    MediumCVSS 5.3No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27448
    21Monitor

    The web application is susceptible to cross-site-scripting attacks.

    MediumCVSS 5.4No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025

  • CVE-2025-27454
    17Monitor

    The application is vulnerable to cross-site request forgery.

    MediumCVSS 4.3No exploitEPSS 0%

    endress · meac300-fnade4 firmwareJul 3, 2025