Information disclosure in Endress+Hauser RSG35 - Ecograph T
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side. It was found that a user with low rights can get information from endpoints that should not be available to this user.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Endress+Hauser | RSG35 - Ecograph T | V2.0.0 and later | — | No fix listed | CNA |
| Endress+Hauser | ORSG35 - Ecograph T Neutral/Private Label | V2.0.0 and later | — | No fix listed | CNA |
| Endress+Hauser | RSG45 - Memograph M | V2.0.0 and later | — | No fix listed | CNA |
| Endress+Hauser | ORSG45 - Memograph M Neutral/Private Label | V2.0.0 and later | — | No fix listed | CNA |
- RSG35 - Ecograph T VendorEndress+Hauser Affected V2.0.0 and later Fixed in — No fix listed CNA
- ORSG35 - Ecograph T Neutral/Private Label VendorEndress+Hauser Affected V2.0.0 and later Fixed in — No fix listed CNA
- RSG45 - Memograph M VendorEndress+Hauser Affected V2.0.0 and later Fixed in — No fix listed CNA
- ORSG45 - Memograph M Neutral/Private Label VendorEndress+Hauser Affected V2.0.0 and later Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:endress:rsg35_firmware:*:*:*:*:*:*:*:* | before 2.0.0 | Vulnerable | Endress |
| cpe:2.3:h:endress:rsg35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Endress |
| cpe:2.3:o:endress:rsg45_firmware:*:*:*:*:*:*:*:* | before 2.0.0 | Vulnerable | Endress |
| cpe:2.3:h:endress:rsg45:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Endress |
| cpe:2.3:o:endress:orsg35_firmware:*:*:*:*:*:*:*:* | before 2.0.0 | Vulnerable | Endress |
| cpe:2.3:h:endress:orsg35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Endress |
| cpe:2.3:o:endress:orsg45_firmware:*:*:*:*:*:*:*:* | before 2.0.0 | Vulnerable | Endress |
| cpe:2.3:h:endress:orsg45:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Endress |
- cpe:2.3:o:endress:rsg35_firmware:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Endress
- cpe:2.3:h:endress:rsg35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress
- cpe:2.3:o:endress:rsg45_firmware:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Endress
- cpe:2.3:h:endress:rsg45:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress
- cpe:2.3:o:endress:orsg35_firmware:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Endress
- cpe:2.3:h:endress:orsg35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress
- cpe:2.3:o:endress:orsg45_firmware:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Endress
- cpe:2.3:h:endress:orsg45:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12496
- 2026-10-03 Alias added: GHSA-wq5p-2cwp-p8wr
References
More Endress+Hauser vulnerabilities
- TI-2024-06118 Endress+Hauser: Multiple products are vulnerable to code injection CVSS 3.1CRITICAL 9.8
- TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1HIGH 8.6
- TI-2024-08118 Missing authentication in SICK AG MSC800 CVSS 3.1HIGH 7.5
Sources
- CVE-2020-12496 · CVE Program
- CVE-2020-12496 · NVD
- FIRST EPSS
- GHSA-wq5p-2cwp-p8wr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences