CVE-2024-6596: Endress+Hauser Echo Curve Viewer, инжекция

Описание

Оригинално описание

An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.

Засегнати продукти

• Endress+Hauser Echo Curve Viewer: до 5.2.2.6
• Endress+Hauser FieldCare SFE500 Package USB: до V1.40.00.7448
• Endress+Hauser FieldCare SFE500 Package Web-Package: до V1.40.00.7448
• Endress+Hauser Field Xpert SMT50: до SMT50_Win10_LTSC_21H2_v1.07.00_RC02_03
• Endress+Hauser Field Xpert SMT70: до SMT70_Win10_LTSC_21H2_v1.07.00_RC02_01
• Endress+Hauser Field Xpert SMT77: до SMT77_Win10_SAC_22H2_v1.08.04_RC03_02
• Endress+Hauser Field Xpert SMT79: до V1.08.02-1.8.8684.34292
• endress\+hauser: още 7 продукта, добавени от endress\+hauser

  echo_curve_viewer_firmware, fieldcare_sfe500_package_usb_firmware, fieldcare_sfe500_package_web-package_firmware, field_xpert_smt70_firmware, field_xpert_smt50_firmware, field_xpert_smt77_firmware, field_xpert_smt79_firmware

Вид слабост

• CWE-94 Неправилен контрол при генериране на код

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-6596
• https://nvd.nist.gov/vuln/detail/CVE-2024-6596
• https://cert.vde.com/en/advisories/VDE-2024-041