Endress+Hauser MEAC300-FNADE4 Missing Authorization Vulnerability

A vulnerability has been identified in the Endress+Hauser MEAC300-FNADE4 product, all firmware versions, where the device automatically logs in the EPC2 Windows user during startup without requiring a password. This issue represents a missing authorization flaw, potentially allowing unauthorized access to the user's session.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the EPC2 Windows user account, allowing an attacker to interact with the system under that user's privileges.

Remediation

Users are advised to update the Endress+Hauser MEAC300-FNADE4 to the latest version. General security practices should also be applied to minimize network exposure and ensure the device operates in a secure IT environment.