What is the CVSS score of CVE-2024-6596?

CVE-2024-6596 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Echo Curve Viewer CVE-2024-6596

Q: Which versions of Echo Curve Viewer are affected by CVE-2024-6596?

An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.

CRITICAL

Code Injection (CWE-94)

2024-09-10 info@cert.vde.com

Code Injection RCE Echo Curve Viewer Fieldcare Sfe500 Package Field Xpert Smt79 Firmware Field Xpert Smt77 Firmware Field Xpert Smt70 Firmware Field Xpert Smt50 Firmware

9.8

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Sep 10, 2024 - 08:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

An unauthenticated remote attacker can run malicious c

code included in curve files and execute commands in the users context.

AnalysisAI

An unauthenticated remote attacker can run malicious c

code included in curve files and execute commands in the users context. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. An unauthenticated remote attacker can run malicious c

code included in curve files and execute commands in the users context. Affected products include: Endress Echo Curve Viewer, Endress Fieldcare Sfe500 Package, Endress Field Xpert Smt79 Firmware, Endress Field Xpert Smt77 Firmware, Endress Field Xpert Smt70 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.