CRITICAL🇵🇱 Wersja polska

CVE-2023-25178

CVSS 9.8v3.1pub. 2023-07-13upd. 2024-11-21

Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Honeywell C300

    HW
    Honeywell
    all versions

  • Honeywell C300 Firmware

    OS
    Honeywell
    501.1 – 501.6hf8510.1 – 510.2hf12511.1 – 511.5tcu3520.1 – 520.1tcu4520.2 – 520.2tcu2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-24480CRITICAL9.8PL ✓same product

Przepełnienie stosu (stack overflow) w sterowniku Honeywell C300

CVE-2023-25770CRITICAL9.8PL ✓same product

Honeywell C300: buffer overflow prowadzący do DoS kontrolera

CVE-2021-38395CRITICAL9.1PL ✓same product

RCE i DoS w sterownikach Honeywell Experion PKS poprzez injection w danych wyjściowych

CVE-2021-38397CRITICAL10.0PL ✓same product

Unrestricted file upload w kontrolerach Honeywell Experion PKS umożliwia RCE

CVE-2023-26597HIGH7.5same product

Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controlle...