High severity · published Sep 2, 2025
CVE-2025-41690
Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions
7.4
CVSS
0.2%
EPSS
No
On KEV
Description
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
Promag 10 with HART · Endress+Hauser
before 01.00.06 · source: vendor
P1
Promag 10 with IO-Link · Endress+Hauser
before 01.00.02 · source: vendor
P1
Promag 10 with Modbus · Endress+Hauser
before 01.00.06 · source: vendor
P1
Promass 10 with HART · Endress+Hauser
before 01.00.06 · source: vendor
P1
Promass 10 with IO-Link · Endress+Hauser
before 01.00.02 · source: vendor
P1
Promass 10 with Modbus · Endress+Hauser
before 01.00.06 · source: vendor