Fdi Package Library
Monthly
Endress+Hauser FDI Package Library versions 1.00.00 through 2.01.00 exposes a CWE-427 (Uncontrolled Search Path Element) flaw in its iDTM FDI component, allowing a locally privileged attacker to activate the debug interface by dropping a crafted file into the application directory. Successful exploitation grants unauthorized access to connected industrial field devices, enabling data exfiltration, configuration manipulation, or operational disruption. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for elevated privileges and local host access - significantly limiting the realistic attack surface.
Endress+Hauser FDI Package Library versions 1.00.00 through 2.01.00 exposes a CWE-427 (Uncontrolled Search Path Element) flaw in its iDTM FDI component, allowing a locally privileged attacker to activate the debug interface by dropping a crafted file into the application directory. Successful exploitation grants unauthorized access to connected industrial field devices, enabling data exfiltration, configuration manipulation, or operational disruption. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for elevated privileges and local host access - significantly limiting the realistic attack surface.