Endress+Hauser MEAC300-FNADE4 Multiple Vulnerabilities

Several vulnerabilities have been identified in the Endress+Hauser MEAC300-FNADE4, all versions, that can be accessed via Ethernet. These vulnerabilities could allow a remote, unauthenticated attacker to compromise the availability, integrity, and confidentiality of the device. One specific issue involves the PHPSESSION cookie, which lacks the HttpOnly flag, allowing access by JavaScript. Additionally, the web application is vulnerable to cross-site scripting (XSS) attacks, SQL injection, and cross-site request forgery (CSRF).

Impact

Exploitation of these vulnerabilities could lead to unauthorized access and manipulation of data, interception of sensitive information, and unauthorized actions being performed on behalf of users.

Remediation

Customers are strongly advised to update to the newest version. General security practices should also be applied to minimize network exposure and restrict access to the device.