Lucene search

IcscertCVE-2014-5436

HistoryApr 08, 2019 - 4:29 p.m.

CVE-2014-5436

2019-04-0816:29:00

CWE-22

icscert

web.nvd.nist.gov

cve

2014

5436

directory traversal

vulnerability

confd.exe

honeywell

experion pks

r40x

r41x

r43x

information disclosure

upgrade

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

74.9%

JSON

A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.

Affected configurations

Nvd

Node

honeywellexperion_process_knowledge_systemRanger400–r400.6

honeywellexperion_process_knowledge_systemRanger410–r410.6

honeywellexperion_process_knowledge_systemRanger430–r430.2

VendorProductVersionCPE
honeywellexperion_process_knowledge_system*cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
honeywell	experion_process_knowledge_system	*	cpe:2.3:a:honeywell:experion_process_knowledge_system::::::::

CNA Affected

[
  {
    "product": "Experion PKS",
    "vendor": "Honeywell",
    "versions": [
      {
        "status": "affected",
        "version": "R40x before R400.6"
      },
      {
        "status": "affected",
        "version": "R41x before R410.6"
      },
      {
        "status": "affected",
        "version": "R43x before R430.2"
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSA-14-352-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.2

Confidence

High

EPSS

0.004

Percentile

74.9%

JSON

Related for CVE-2014-5436