CVE-2024-6596: Endress Echo Curve Viewer

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.

Affected products

• Endress Echo Curve Viewer: before 6.0.0 (fixed in 6.0.0)
• Endress Field Xpert SMT50 Firmware: affected versions not specified
• Endress Field Xpert SMT70 Firmware: affected versions not specified
• Endress Field Xpert SMT77 Firmware: affected versions not specified
• Endress Field Xpert SMT79 Firmware: affected versions not specified
• Endress Fieldcare SFE500 Package: before 1.40.1 (fixed in 1.40.1)

Published 2024-09-10. Last modified 2026-06-17.