CVE-2020-12495 json
ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management
published 2020-11-19 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4797
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 60%
- public exploits
- 0
- none known
Summary
Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The vulnerability is that user sessions are not closed correctly and a user with fewer rights is assigned the higher rights when he logs on.
Patch / fix
- Endress+Hauser RSG35 - Ecograph T V2.0.0
- Endress+Hauser ORSG35 - Ecograph T Neutral/Private Label V2.0.0
Exploit prediction
0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Endress+Hauser RSG35 - Ecograph T
- Endress+Hauser ORSG35 - Ecograph T Neutral/Private Label
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
cert.vde.com
/en-us/advisories/vde-2020-021
vendor-advisory
Sources
- CVE List CVE-2020-12495
- NVD CVE-2020-12495
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.