Lucene search

HoneywellCVELIST:CVE-2023-5392

HistoryApr 11, 2024 - 7:19 p.m.

CVE-2023-5392

2024-04-1119:19:19

CWE-1295

Honeywell

www.cve.org

c300

information leak

network

memory extraction

honeywell

update

security notification

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Experion PKS"
    ],
    "product": "C300",
    "vendor": "Honeywell",
    "versions": [
      {
        "lessThanOrEqual": "520.2 TCU4",
        "status": "affected",
        "version": "520.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "510.2 HF13",
        "status": "affected",
        "version": "510.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "520.1 TCU4",
        "status": "affected",
        "version": "520.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "511.5 TCU4 HF3",
        "status": "affected",
        "version": "511.1",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Experion LX"
    ],
    "product": "C300",
    "vendor": "Honeywell",
    "versions": [
      {
        "lessThanOrEqual": "520.2 TCU4",
        "status": "affected",
        "version": "520.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "511.5 TCU4 HF3",
        "status": "affected",
        "version": "511.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "520.1 TCU4",
        "status": "affected",
        "version": "520.1",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "PlantCruise by Experion"
    ],
    "product": "C300",
    "vendor": "Honeywell",
    "versions": [
      {
        "lessThanOrEqual": "520.2 TCU4",
        "status": "affected",
        "version": "520.2",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "520.1 TCU4",
        "status": "affected",
        "version": "520.1",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "511.5 TCU4 HF3",
        "status": "affected",
        "version": "520.2 TCU4 HFR2",
        "versionType": "semver"
      }
    ]
  }
]

References

process.honeywell.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2023-5392