CVE-2014-2717

2014-07-2414:55:07

[email protected]

web.nvd.nist.gov

cve-2014-2717

honeywell

falcon xlweb

linux

xlwebexe

controller devices

authentication bypass

administrative access

nvd

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.7%

JSON

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.

Affected configurations

NVD

Node

honeywellfalcon_xlweb_linux_controllerRange≤2.04.01

honeywellfalcon_xlweb_xlwebexeRange≤2.02.11

CPENameOperatorVersion
honeywell:falcon_xlweb_linux_controllerhoneywell falcon xlweb linux controllerle2.04.01
honeywell:falcon_xlweb_xlwebexehoneywell falcon xlweb xlwebexele2.02.11

CPE	Name	Operator	Version
honeywell:falcon_xlweb_linux_controller	honeywell falcon xlweb linux controller	le	2.04.01
honeywell:falcon_xlweb_xlwebexe	honeywell falcon xlweb xlwebexe	le	2.02.11