Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions
Priority LOW 34CWE-532Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed Promag 10 with HART (Endress+Hauser): 01.00.06Promag 10 with IO-Link (Endress+Hauser): 01.00.02+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Endress+Hauser | Promag 10 with HART | before 01.00.06 | 01.00.06 | Patch available | CNA |
| Endress+Hauser | Promag 10 with IO-Link | before 01.00.02 | 01.00.02 | Patch available | CNA |
| Endress+Hauser | Promag 10 with Modbus | before 01.00.06 | 01.00.06 | Patch available | CNA |
| Endress+Hauser | Promass 10 with HART | before 01.00.06 | 01.00.06 | Patch available | CNA |
| Endress+Hauser | Promass 10 with IO-Link | before 01.00.02 | 01.00.02 | Patch available | CNA |
| Endress+Hauser | Promass 10 with Modbus | before 01.00.06 | 01.00.06 | Patch available | CNA |
- Promag 10 with HART VendorEndress+Hauser Affected before 01.00.06 Fixed in 01.00.06 Patch available CNA
- Promag 10 with IO-Link VendorEndress+Hauser Affected before 01.00.02 Fixed in 01.00.02 Patch available CNA
- Promag 10 with Modbus VendorEndress+Hauser Affected before 01.00.06 Fixed in 01.00.06 Patch available CNA
- Promass 10 with HART VendorEndress+Hauser Affected before 01.00.06 Fixed in 01.00.06 Patch available CNA
- Promass 10 with IO-Link VendorEndress+Hauser Affected before 01.00.02 Fixed in 01.00.02 Patch available CNA
- Promass 10 with Modbus VendorEndress+Hauser Affected before 01.00.06 Fixed in 01.00.06 Patch available CNA
Remediation
- Fix · CNA Promag 10 with HART (Endress+Hauser) Fixed in 01.00.06
- Fix · CNA Promag 10 with IO-Link (Endress+Hauser) Fixed in 01.00.02
- Fix · CNA Promag 10 with Modbus (Endress+Hauser) Fixed in 01.00.06
- Fix · CNA Promass 10 with HART (Endress+Hauser) Fixed in 01.00.06
- Fix · CNA Promass 10 with IO-Link (Endress+Hauser) Fixed in 01.00.02
- Fix · CNA Promass 10 with Modbus (Endress+Hauser) Fixed in 01.00.06
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41690
- 2026-10-18 Alias added: GHSA-rjm8-q5m3-8v9h
References
More Endress+Hauser vulnerabilities
- TI-2024-06118 Endress+Hauser: Multiple products are vulnerable to code injection CVSS 3.1CRITICAL 9.8
- TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1HIGH 8.6
- TI-2024-08118 Missing authentication in SICK AG MSC800 CVSS 3.1HIGH 7.5
Sources
- CVE-2025-41690 · CVE Program
- CVE-2025-41690 · NVD
- FIRST EPSS
- GHSA-rjm8-q5m3-8v9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences