CVE-2017-5139

🗓️ 13 Feb 2017 21:00:00Reported by icscertType

An issue in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior allows password disclosure via specific URL due to Plaintext Storage of Password

Reporter	Title	Published	Views	Family All 8
CNVD	Honeywell XL Web II Controller Clear Text Stored Password Vulnerability	5 Feb 201700:00	–	cnvd
Cvelist	CVE-2017-5139	13 Feb 201721:00	–	cvelist
EUVD	EUVD-2017-14248	7 Oct 202500:30	–	euvd
ICS	Honeywell XL Web II Controller Vulnerabilities	2 Feb 201700:00	–	ics
NVD	CVE-2017-5139	13 Feb 201721:59	–	nvd
OpenVAS	Honeywell XL Web Multiple Vulnerabilities	3 Feb 201700:00	–	openvas
OSV	CVE-2017-5139	13 Feb 201721:59	–	osv
Prion	Default credentials	13 Feb 201721:59	–	prion

NVD

Vulners

Node

honeywell xl_web_ii_controllerMatchxlwebexe-1-02-08

honeywell xl_web_ii_controllerMatchxlwebexe-2-01-00

AND

honeywell xl_web_ii_controllerMatch-

[
  {
    "product": "Honeywell XL Web II Controller",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Honeywell XL Web II Controller"
      }
    ]
  }
]

Source	Link
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-17-033-01
securityfocus	www.securityfocus.com/bid/95971

13 May 2026 00:24Current

9.3High risk

Vulners AI Score9.3

CVSS 25

CVSS 39.8

EPSS0.00419

CWE-522

honeywell xl web ii controller password disclosure plaintext storage cve-2017-5139 security vulnerability