CVE-2024-6596
Endress+Hauser: Multiple products are vulnerable to code injection
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Endress+Hauser: Multiple products are vulnerable to code injection
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Record
CVE-2024-6596- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-47661
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Record
EUVD-2024-47661- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hmhp-m2mf-h8m9
An unauthenticated remote attacker can run malicious c# code included in curve files and execute...
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Record
GHSA-hmhp-m2mf-h8m9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
- Record
CVE-2024-6596- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
- endress echo curve viewer
- endress field xpert smt50 firmware
- endress field xpert smt70 firmware
- endress field xpert smt77 firmware
- endress field xpert smt79 firmware
- endress fieldcare sfe500 package
- endress+hauser echo curve viewer
- endress+hauser field xpert smt50
- endress+hauser field xpert smt70
- endress+hauser field xpert smt77
- endress+hauser field xpert smt79
- endress+hauser fieldcare sfe500 package usb
Show 8 moreShow less
- endress+hauser fieldcare sfe500 package web-package
- endress\+hauser echo curve viewer firmware
- endress\+hauser field xpert smt50 firmware
- endress\+hauser field xpert smt70 firmware
- endress\+hauser field xpert smt77 firmware
- endress\+hauser field xpert smt79 firmware
- endress\+hauser fieldcare sfe500 package usb firmware
- endress\+hauser fieldcare sfe500 package web-package firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-6596 is a critical vulnerability (CVSS 9.8) in Endress Echo Curve Viewer, published September 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. No source names a fixed version.