CVE-2020-12495

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege management. The affected device has a web-based user interface with a role-based access system. Users with different roles have different write and read privileges. The access system is based on dynamic "tokens". The vulnerability is that user sessions are not closed correctly and a user with fewer rights is assigned the higher rights when he logs on.

• CWE-269
• CWE-269

• https://cert.vde.com/en-us/advisories/vde-2020-021Vendor Advisory
• https://cert.vde.com/en-us/advisories/vde-2020-021Vendor Advisory

Published

Nov 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12488The attacker can access the sensitive information stored wit…5.5
• CVE-2020-1249An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12491Improper control of framework service permissions with possi…4.8
• CVE-2020-12492Improper handling of WiFi information by framework services …1
• CVE-2020-12493An open port used for debugging in SWARCOs CPU LS4000 Series…10
• CVE-2020-12494Beckhoff's TwinCAT RT network driver for Intel 8254x and 825…5.3
• CVE-2020-12496Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, OR…6.5
• CVE-2020-12497PLCopen XML file parsing in Phoenix Contact PC Worx and PC W…7.8
• CVE-2020-12498mwe file parsing in Phoenix Contact PC Worx and PC Worx Expr…7.8
• CVE-2020-12499In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and ear…7.3
• CVE-2020-1250<p>An information disclosure vulnerability exists when the w…5.5
• CVE-2020-12500Improper Authorization vulnerability of Pepperl+Fuchs P+F Co…9.8