Information disclosure in Endress+hauser Promag 10 With Hart
CVE-2025-41690
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (15.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.000
Affected products
- Endress+hauser Promag 10 With Hart — versions 0
- Endress+hauser Promag 10 With Io-Link — versions 0
- Endress+hauser Promag 10 With Modbus — versions 0
- Endress+hauser Promass 10 With Hart — versions 0
- Endress+hauser Promass 10 With Io-Link — versions 0
- Endress+hauser Promass 10 With Modbus — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-41690?
- CVE-2025-41690 is a high-severity vulnerability in Endress+hauser Promag 10 With Hart, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.4/10. Published 2025-09-02.
- How severe is CVE-2025-41690?
- High severity. CVSS v3 base score is 7.4 out of 10.