What is CVE-2020-12496?

CVE-2020-12496 is a medium-severity vulnerability in Endress Orsg35, classified under Information Disclosure. CVSS score: 6.5/10. Published 2020-11-19.

How severe is CVE-2020-12496?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in Endress Orsg35

CVE-2020-12496

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side. It was found that a user with low rights can get information from endpoints that should not be available to this user.

Vulnerability class: Information Disclosure

EPSS: 0.008 (53.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Endress Orsg35
Endress Orsg35_firmware
Endress Orsg45
Endress Orsg45_firmware
Endress Rsg35
Endress Rsg35_firmware
Endress Rsg45
Endress Rsg45_firmware
Endress+hauser Orsg35 - Ecograph T Neutral/private Label — versions V2.0.0
Endress+hauser Orsg45 - Memograph M Neutral/private Label — versions V2.0.0

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

info@cert.vde.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2020-12496?: CVE-2020-12496 is a medium-severity vulnerability in Endress Orsg35, classified under Information Disclosure. CVSS score: 6.5/10. Published 2020-11-19.
How severe is CVE-2020-12496?: Medium severity. CVSS v3 base score is 6.5 out of 10.