The vulnerability identified as CVE-2026-9593 affects the iDTM FDI component of the Endress+Hauser FDI Package library version 1.00.00. It is classified under CWE-427 (Uncontrolled Search Path Element). An attacker who already has elevated privileges and access to the host system can exploit this by placing a specially crafted file in the application directory, which enables the debug interface. This unauthorized activation of the debug interface may allow the attacker to access connected devices improperly and potentially expose, modify, or disrupt device data or operations. The CVSS 4.0 base score is 8.4, indicating high severity, with attack vector local, low attack complexity, no user interaction required, and high impacts on confidentiality, integrity, and availability.

Successful exploitation requires elevated privileges and local access to the host system. The attacker can enable a debug interface that is not intended to be active, leading to unauthorized access to connected devices. This can result in exposure of sensitive device data, unauthorized modification, or disruption of device operations. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

No official patch or remediation level has been published by the vendor as of the current information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict elevated access to trusted users only and monitor for unauthorized file placements in the application directory to reduce risk.