VDE-2021-005

Vulnerability from csaf_endresshauserag - Published: 2021-03-01 06:39 - Updated: 2025-05-14 13:00
Summary
Endress+Hauser: Multiple Devices affected by fdtContainer vulnerability
Notes
Summary: The fdtCONTAINER component is integrated into an application (host application). The fdtCONTAINER application is a specific host application which integrates the fdtCONTAINER component. The fdtCONTAINER component exchanges binary data blobs with such a host application. Typically, the host application saves these binary data blobs into a project storage (project file or a project database). To manipulate the data inside the project storage, the attacker needs write access to this project storage. Additionally, the manipulated project needs to be opened by the host application. It depends on the host application whether opening the project requires a user action or not. In fdtCONTAINER applications, the user has to open the manipulated project file manually. In the case of opening a stored project, the deserialization of the manipulated data can be exploited.
Impact: The engineering workstation, on which the host application is executed, might execute malicious code with the user rights of the host application.
Mitigation: 1. Exchange project data only via secure exchange services 2. Use appropriate means to protect the project storage from unauthorized manipulation 3. Do not open project data from an unknown source 4. Reduce the user rights of the host application to the necessary minimum
Remediation: Planned for future versions
CVE-2020-12525

M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.

7.3 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Mitigation 1. Exchange project data only via secure exchange services 2. Use appropriate means to protect the project storage from unauthorized manipulation 3. Do not open project data from an unknown source 4. Reduce the user rights of the host application to the necessary minimum
Vendor Fix Planned for future versions
Affected products
Product Identifier Version Remediation
Asset Health Monitoring (FieldCare SFE500) <=2.15.01
Endress+Hauser / Software / Asset Health Monitoring (FieldCare SFE500)
 SRP700 <=2.15.01
DeviceCare <=1.07.00
Endress+Hauser / Software / DeviceCare
 SFE100 <=1.07.00
FieldCare <=2.15.01
Endress+Hauser / Software / FieldCare
 SFE500 <=2.15.01
Field Xpert <=1.05.00
Endress+Hauser / Software / Field Xpert
 SMT50SMT70SMT77 <=1.05.00
References
Acknowledgments
CERT@VDE certvde.com
M&M Software GmbH
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "organization": "M\u0026M Software GmbH",
        "summary": "reporting."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "The fdtCONTAINER component is integrated into an application (host application). The fdtCONTAINER application is a specific host application which integrates the fdtCONTAINER component.\n\nThe fdtCONTAINER component exchanges binary data blobs with such a host application. Typically, the host application saves these binary data blobs into a project storage (project file or a project database).\n\nTo manipulate the data inside the project storage, the attacker needs write access to this project storage. Additionally, the manipulated project needs to be opened by the host application. It depends on the host application whether opening the project requires a user action or not. In\nfdtCONTAINER applications, the user has to open the manipulated project file manually.\n\nIn the case of opening a stored project, the deserialization of the manipulated data can be exploited.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The engineering workstation, on which the host application is executed, might execute malicious code with the user rights of the host application.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "1. Exchange project data only via secure exchange services\n2. Use appropriate means to protect the project storage from unauthorized manipulation\n3. Do not open project data from an unknown source\n4. Reduce the user rights of the host application to the necessary minimum",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Planned for future versions",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@endress.com",
      "name": "Endress+Hauser AG",
      "namespace": "https://www.endress.com"
    },
    "references": [
      {
        "category": "external",
        "summary": "Endress+Hauser advisory overview at CERT@VDE",
        "url": "https://certvde.com/de/advisories/vendor/endress+hauser/"
      },
      {
        "category": "self",
        "summary": "VDE-2021-005: Endress+Hauser: Multiple Devices affected by fdtContainer vulnerability - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2021-005"
      },
      {
        "category": "self",
        "summary": "VDE-2021-005: Endress+Hauser: Multiple Devices affected by fdtContainer vulnerability - CSAF",
        "url": "https://endress-hauser.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2021-005.json"
      }
    ],
    "title": "Endress+Hauser: Multiple Devices affected by fdtContainer vulnerability",
    "tracking": {
      "aliases": [
        "VDE-2021-005"
      ],
      "current_release_date": "2025-05-14T13:00:14.000Z",
      "generator": {
        "date": "2025-03-12T10:58:11.003Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.20"
        }
      },
      "id": "VDE-2021-005",
      "initial_release_date": "2021-03-01T06:39:00.000Z",
      "revision_history": [
        {
          "date": "2021-03-01T06:39:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2025-05-14T13:00:14.000Z",
          "number": "2",
          "summary": "Fix: added distribution"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2.15.01",
                    "product": {
                      "name": "Asset Health Monitoring (FieldCare SFE500) \u003c=2.15.01",
                      "product_id": "CSAFPID-51001",
                      "product_identification_helper": {
                        "model_numbers": [
                          "SRP700"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "Asset Health Monitoring (FieldCare SFE500)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.07.00",
                    "product": {
                      "name": "DeviceCare \u003c=1.07.00",
                      "product_id": "CSAFPID-51002",
                      "product_identification_helper": {
                        "model_numbers": [
                          "SFE100"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "DeviceCare"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=2.15.01",
                    "product": {
                      "name": "FieldCare \u003c=2.15.01",
                      "product_id": "CSAFPID-51003",
                      "product_identification_helper": {
                        "model_numbers": [
                          "SFE500"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "FieldCare"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "\u003c=1.05.00",
                    "product": {
                      "name": "Field Xpert \u003c=1.05.00",
                      "product_id": "CSAFPID-51004",
                      "product_identification_helper": {
                        "model_numbers": [
                          "SMT50",
                          "SMT70",
                          "SMT77"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "Field Xpert"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Endress+Hauser"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004"
        ],
        "summary": "Affected Products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-12525",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "description",
          "text": "M\u0026M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "1. Exchange project data only via secure exchange services\n2. Use appropriate means to protect the project storage from unauthorized manipulation\n3. Do not open project data from an unknown source\n4. Reduce the user rights of the host application to the necessary minimum",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Planned for future versions",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.3,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004"
          ]
        }
      ],
      "title": "CVE-2020-12525"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.