Information disclosure in Endress+hauser Promag 10 With Hart
CVE-2025-41690
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
EPSS: 0.002 (13.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Endress+hauser Promag 10 With Hart — versions 0
- Endress+hauser Promag 10 With Io-link — versions 0
- Endress+hauser Promag 10 With Modbus — versions 0
- Endress+hauser Promass 10 With Hart — versions 0
- Endress+hauser Promass 10 With Io-link — versions 0
- Endress+hauser Promass 10 With Modbus — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-41690?
- CVE-2025-41690 is a high-severity vulnerability in Endress+hauser Promag 10 With Hart, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.4/10. Published 2025-09-02.
- How severe is CVE-2025-41690?
- High severity. CVSS v3 base score is 7.4 out of 10.