CVE-2025-41690
Published: Sep 2, 2025
Modified: Sep 2, 2025
CVSS v3.1
7.4
Description
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
| Vendor | Product | Versions |
|---|---|---|
Endress+Hauser | Promag 10 with HART | affected 0 - < 01.00.06 |
Endress+Hauser | Promag 10 with IO-Link | affected 0 - < 01.00.02 |
Endress+Hauser | Promag 10 with Modbus | affected 0 - < 01.00.06 |
Endress+Hauser | Promass 10 with HART | affected 0 - < 01.00.06 |
Endress+Hauser | Promass 10 with IO-Link | affected 0 - < 01.00.02 |
Endress+Hauser | Promass 10 with Modbus | affected 0 - < 01.00.06 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now