CVE-2020-12496: ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-19 · updated 2026-06-17
Weakness: CWE-200

Description

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side. It was found that a user with low rights can get information from endpoints that should not be available to this user.

Affected products

Endress Orsg35 Firmware: before 2.0.0 — fixed in 2.0.0
Endress Orsg45 Firmware: before 2.0.0 — fixed in 2.0.0
Endress Rsg35 Firmware: before 2.0.0 — fixed in 2.0.0
Endress Rsg45 Firmware: before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: Endress Orsg35 Firmware 2.0.0; Endress Orsg45 Firmware 2.0.0; Endress Rsg35 Firmware 2.0.0; Endress Rsg45 Firmware 2.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-12496 or the next vulnerability affects your stack