CVE-2023-5390

An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://process.honeywell.com	Product
https://www.honeywell.com/us/en/product-security	Not Applicable

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-31 18:15

Updated : 2024-07-09 20:15

NVD link : CVE-2023-5390

Mitre link : CVE-2023-5390

CVE.ORG link : CVE-2023-5390

JSON object : View

Products Affected

honeywell

controledge_virtual_unit_operations_controller_firmware
controledge_unit_operations_controller
controledge_virtual_unit_operations_controller
controledge_unit_operations_controller_firmware

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-36

Absolute Path Traversal

{"id": "CVE-2023-5390", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-01-31T18:15:46.780", "references": [{"url": "https://process.honeywell.com", "tags": ["Product"], "source": "psirt@honeywell.com"}, {"url": "https://www.honeywell.com/us/en/product-security", "tags": ["Not Applicable"], "source": "psirt@honeywell.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-36"}]}], "descriptions": [{"lang": "en", "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning."}, {"lang": "es", "value": "Un atacante podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la lectura de archivos desde Honeywell Experion ControlEdge VirtualUOC y ControlEdge UOC. Esta explotaci\u00f3n podr\u00eda usarse para leer archivos del controlador que pueden exponer informaci\u00f3n limitada del dispositivo. Honeywell recomienda actualizar a la versi\u00f3n m\u00e1s reciente del producto. Consulte la Notificaci\u00f3n de seguridad de Honeywell para obtener recomendaciones sobre actualizaci\u00f3n y control de versiones."}], "lastModified": "2024-07-09T20:15:08.647", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B528F553-0D96-4A1D-9ABE-DA9555534BB2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E30EFCB6-6534-46EE-A743-2218FD0DAA81"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67C0BF18-A928-4A47-A71E-2216BE4ECB90"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F436C92C-7EED-44A5-B53D-12B54652D0A1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}