CVE-2024-6596: Endress Echo Curve Viewer RCE Vulnerability

CVE-2024-6596 Overview

CVE-2024-6596 is a critical code injection vulnerability affecting multiple Endress+Hauser industrial automation products, including the Echo Curve Viewer, FieldCare SFE500 Package, and the Field Xpert SMT series of handheld devices. An unauthenticated remote attacker can execute malicious C# code embedded within specially crafted curve files, leading to arbitrary command execution in the context of the user running the vulnerable application.

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), representing a severe security risk in industrial control system (ICS) environments where these tools are commonly deployed for device configuration and diagnostics.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution by crafting malicious curve files containing embedded C# payloads, potentially compromising industrial control systems and sensitive operational technology environments.

Affected Products

• Endress+Hauser Echo Curve Viewer
• Endress+Hauser FieldCare SFE500 Package
• Endress+Hauser Field Xpert SMT79 (and firmware)
• Endress+Hauser Field Xpert SMT77 (and firmware)
• Endress+Hauser Field Xpert SMT70 (and firmware)
• Endress+Hauser Field Xpert SMT50 (and firmware)

Discovery Timeline

• September 10, 2024 - CVE-2024-6596 published to NVD
• October 1, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6596

Vulnerability Analysis

This vulnerability stems from unsafe handling of curve files processed by the affected Endress+Hauser applications. The vulnerable software fails to properly sanitize or validate C# code embedded within curve file formats, allowing attackers to inject and execute arbitrary code without authentication.

The attack requires no user interaction beyond opening or processing a malicious curve file, which is particularly concerning given the network accessibility of the vulnerability. Industrial environments often involve the transfer of curve files between systems for device calibration and diagnostics, making this attack vector highly relevant to operational workflows.

The vulnerability enables complete compromise of the affected system with the same privileges as the user running the application. In industrial environments, this often means administrative or elevated privileges, potentially allowing attackers to pivot to connected industrial control systems.

Root Cause

The root cause of CVE-2024-6596 is improper input validation in the curve file parsing functionality. The affected applications dynamically interpret C# code contained within curve files without adequate security controls or sandboxing. This design flaw allows untrusted code to be executed directly by the .NET runtime, bypassing any security boundaries that should exist between file data and executable code.

The vulnerability is exacerbated by the lack of authentication requirements, meaning any attacker with network access to the affected system can exploit this flaw without providing credentials.

Attack Vector

The attack vector for CVE-2024-6596 is network-based, requiring the attacker to deliver a malicious curve file to the target system. Attack scenarios include:

1. Phishing/Social Engineering: Sending a crafted curve file via email to industrial operators
2. Man-in-the-Middle: Intercepting legitimate curve file transfers and injecting malicious content
3. Compromised File Repositories: Placing malicious curve files in shared network locations
4. Direct Network Access: If the application exposes network services that accept curve files

The malicious curve file contains embedded C# code that executes when the file is processed by the vulnerable application. The code runs with the privileges of the user context, enabling attackers to execute system commands, establish persistence, exfiltrate data, or pivot to other systems on the network.

Detection Methods for CVE-2024-6596

Indicators of Compromise

• Unexpected C# compilation activity or csc.exe processes spawned by Endress+Hauser applications
• Curve files with unusual sizes or containing text patterns indicative of C# code (e.g., using System;, namespace, class)
• Abnormal network connections originating from Echo Curve Viewer, FieldCare, or Field Xpert processes
• Unexpected child processes spawned by the affected applications

Detection Strategies

• Implement file integrity monitoring on directories where curve files are stored or processed
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious process creation chains involving Endress+Hauser applications
• Create SIEM rules to alert on csc.exe or .NET compilation activity associated with the affected products
• Monitor for PowerShell or cmd.exe processes spawned as children of the vulnerable applications

Monitoring Recommendations

• Enable verbose logging for the affected applications and centralize logs for analysis
• Monitor network traffic for curve file transfers and inspect for embedded code patterns
• Implement application whitelisting to prevent unauthorized code execution from within application directories
• Deploy network segmentation to limit the exposure of systems running the vulnerable applications

How to Mitigate CVE-2024-6596

Immediate Actions Required

• Consult the VDE Security Advisory VDE-2024-041 for vendor-specific patch information and guidance
• Restrict network access to systems running the affected Endress+Hauser applications
• Implement strict file filtering to block or quarantine curve files from untrusted sources
• Train personnel to avoid opening curve files from unknown or untrusted sources
• Apply the principle of least privilege to accounts running the affected applications

Patch Information

Organizations should refer to the VDE Security Advisory VDE-2024-041 published by VDE CERT for official patch information and remediation guidance from Endress+Hauser. Contact Endress+Hauser support directly to obtain updated versions of the affected software and firmware.

Workarounds

• Isolate affected systems in a segmented network zone with limited connectivity
• Implement application-level firewalls or proxies to filter incoming curve files
• Use dedicated, air-gapped systems for processing curve files from external sources
• Deploy endpoint protection solutions capable of detecting code injection attacks
• Consider disabling automatic curve file processing until patches are applied

# Network segmentation example for affected ICS systems
# Restrict access to Endress+Hauser application ports
iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j DROP
# Enable logging for monitoring
iptables -A INPUT -p tcp --dport 445 -j LOG --log-prefix "ENDRESS_ACCESS: "