An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.

An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.

Echo Curve Viewer is an utility used for offline visualization of previously recorded envelope curve data. Envelope curve records are exported from other Endress+Hauser software products like FieldCare as .curves files.

Echo Curve Viewer opens .curves files and displays their contents. The .curves files contain device- specific C# calculation scripts as .cs files, that are needed for the interpretation of certain curve record types.

Echo Curve Viewer loads .curves files and executes the contained C# code.