5.9

CVE-2023-5406

Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. See Honeywell Security Notification for recommendations on upgrading and versioning.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorHoneywell
≫
Product Experion Server
Default Statusunaffected
Version <= 520.2 TCU4
Version 520.2
Status affected
Version <= 510.2 HF13
Version 510.1
Status affected
Version <= 520.1 TCU4
Version 520.1
Status affected
Version <= 511.5 TCU4 HF3
Version 511.1
Status affected
VendorHoneywell
≫
Product Experion Server
Default Statusunaffected
Version <= 520.2 TCU4
Version 520.2
Status affected
Version <= 511.5 TCU4 HF3
Version 511.1
Status affected
Version <= 520.1 TCU4
Version 520.1
Status affected
VendorHoneywell
≫
Product Experion Server
Default Statusunaffected
Version <= 520.2 TCU4
Version 520.2
Status affected
Version <= 520.1 TCU4
Version 520.1
Status affected
Version <= 511.5 TCU4 HF3
Version 520.2 TCU4 HFR2
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.61% 0.689
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@honeywell.com 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.