CVE-2020-12496

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a dynamic token for each request submitted to the server, which makes repeating requests and analysis complex enough. Nevertheless, it's possible and during the analysis it was discovered that it also has an issue with the access-control matrix on the server-side. It was found that a user with low rights can get information from endpoints that should not be available to this user.

• CWE-200
• CWE-200

• https://cert.vde.com/en-us/advisories/vde-2020-022Vendor Advisory
• https://cert.vde.com/en-us/advisories/vde-2020-022Vendor Advisory

Published

Nov 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1249An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-12491Improper control of framework service permissions with possi…4.8
• CVE-2020-12492Improper handling of WiFi information by framework services …1
• CVE-2020-12493An open port used for debugging in SWARCOs CPU LS4000 Series…10
• CVE-2020-12494Beckhoff's TwinCAT RT network driver for Intel 8254x and 825…5.3
• CVE-2020-12495Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, OR…8.8
• CVE-2020-12497PLCopen XML file parsing in Phoenix Contact PC Worx and PC W…7.8
• CVE-2020-12498mwe file parsing in Phoenix Contact PC Worx and PC Worx Expr…7.8
• CVE-2020-12499In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and ear…7.3
• CVE-2020-1250<p>An information disclosure vulnerability exists when the w…5.5
• CVE-2020-12500Improper Authorization vulnerability of Pepperl+Fuchs P+F Co…9.8
• CVE-2020-12501Improper Authorization vulnerability of Pepperl+Fuchs P+F Co…9.8