PatchTheCVEendress vulnerabilities
Recent CVEs affecting endress products. 20 tracked.
endress has 20 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 14. Most recent: 2025-07-03. Highest priority: CVE-2024-6596 (score 53/100).
- CVE-2025-27461 HIGH 7.6 MITIGATE During startup, the device automatically logs in the EPC2 Windows user without requesting a password.
- CVE-2025-27460 HIGH 7.6 MITIGATE The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker
- CVE-2025-27459 MEDIUM 4.4 MITIGATE The VNC application stores its passwords encrypted within the registry but uses DES for encryption
- CVE-2025-27458 MEDIUM 6.5 MITIGATE The VNC authentication mechanism bases on a challenge-response system where both server and client use the sam
- CVE-2025-27457 MEDIUM 6.5 MITIGATE All communication between the VNC server and client(s) is unencrypted
- CVE-2025-27456 HIGH 7.5 MITIGATE The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authenticat
- CVE-2025-27455 MEDIUM 4.3 UPGRADE The web application is vulnerable to clickjacking attacks
- CVE-2025-27454 MEDIUM 4.3 UPGRADE The application is vulnerable to cross-site request forgery
- CVE-2025-27453 MEDIUM 5.3 UPGRADE The HttpOnly flag is set to false on the PHPSESSION cookie
- CVE-2025-27452 MEDIUM 5.3 UPGRADE The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly ins
- CVE-2025-27451 MEDIUM 5.3 UPGRADE For failed login attempts, the application returns different error messages depending on whether the login fai
- CVE-2025-27450 MEDIUM 6.5 UPGRADE The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4
- CVE-2025-27449 HIGH 7.5 UPGRADE The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts w
- CVE-2025-27448 MEDIUM 6.8 UPGRADE The web application is susceptible to cross-site-scripting attacks
- CVE-2025-27447 HIGH 7.4 UPGRADE The web application is susceptible to cross-site-scripting attacks
- CVE-2025-1711 MEDIUM 4.3 UPGRADE Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.
- CVE-2025-1710 HIGH 7.5 UPGRADE The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication a
- CVE-2025-1709 MEDIUM 6.5 UPGRADE Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded).
- CVE-2025-1708 HIGH 8.6 UPGRADE The application is vulnerable to SQL injection attacks
- CVE-2024-6596 CRITICAL 9.8 UPGRADE UPGRADE An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in t
FAQ
How do I fix endress vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is endress being exploited right now?
None of the tracked endress CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which endress CVE should I patch first?
CVE-2024-6596 currently ranks highest (53/100): An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in t.