iDTM FDI Unauthorized Debug Interface Enablement
Priority LOW 38CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00169 6th percentileScored 2026-11-07
Fix Fixed FDI Package library (Endress+Hauser): 2.01.00
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Endress+Hauser | FDI Package library | 1.00.00 to before 2.01.00 | 2.01.00 | Patch available | CNA |
- FDI Package library VendorEndress+Hauser Affected 1.00.00 to before 2.01.00 Fixed in 2.01.00 Patch available CNA
Remediation
- Fix · CNA FDI Package library (Endress+Hauser) Fixed in 2.01.00
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9593
- 2026-10-03 Alias added: GHSA-853j-hcj8-c5p2
References
More Endress+Hauser vulnerabilities
- TI-2024-06118 Endress+Hauser: Multiple products are vulnerable to code injection CVSS 3.1CRITICAL 9.8
- TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
- TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1HIGH 8.6
- TI-2024-08118 Missing authentication in SICK AG MSC800 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-9593 · CVE Program
- CVE-2026-9593 · NVD
- FIRST EPSS
- GHSA-853j-hcj8-c5p2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences