7.4

CVE-2023-5396

Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorHoneywell
≫
Product Experion Server
Default Statusunaffected
Version <= 520.2 TCU4
Version 520.2
Status affected
Version <= 510.2 HF13
Version 510.1
Status affected
Version <= 520.1 TCU4
Version 520.1
Status affected
Version <= 511.5 TCU4 HF3
Version 511.1
Status affected
VendorHoneywell
≫
Product Experion Server
Default Statusunaffected
Version <= 520.2 TCU4
Version 520.2
Status affected
Version <= 511.5 TCU4 HF3
Version 511.1
Status affected
Version <= 520.1 TCU4
Version 520.1
Status affected
VendorHoneywell
≫
Product Experion Server
Default Statusunaffected
Version <= 520.2 TCU4
Version 520.2
Status affected
Version <= 520.1 TCU4
Version 520.1
Status affected
Version <= 511.5 TCU4 HF3
Version 520.2 TCU4 HFR2
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.85% 0.741
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@honeywell.com 7.4 2.2 5.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE-805 Buffer Access with Incorrect Length Value

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.