Common Weakness Enumeration
CWE-121
AllowedStack-based Buffer Overflow
Abstraction: Variant · Status: Draft
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
5238 vulnerabilities reference this CWE, most recent first.
CVE-2023-6693 (GCVE-0-2023-6693)
Vulnerability from cvelistv5 – Published: 2024-01-02 09:15 – Updated: 2026-02-25 18:20
VLAI
EPSS
VEX
Title
Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()
Summary
A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2024:2962 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2025:4492 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2023-6693 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2254580 | issue-trackingx_refsource_REDHAT |
| https://lists.fedoraproject.org/archives/list/pac… | x_transferred |
| https://security.netapp.com/advisory/ntap-2024020… | x_transferred |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
8100020240314161907.e155f54d , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
17:9.0.0-10.el9_5.3 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::appstream |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 Advanced Virtualization |
cpe:/a:redhat:advanced_virtualization:8::el8 |
Date Public
2024-01-02 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:29:06.244Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2024:2962",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2024:2962"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2023-6693"
},
{
"name": "RHBZ#2254580",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254580"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGUN5HVOXESW7MSNM44E4AE2VNXQB6Y/"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20240208-0004/"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00042.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6693",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-21T14:46:00.186400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-21T14:46:18.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"defaultStatus": "affected",
"packageName": "virt-devel:rhel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020240314161907.e155f54d",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"defaultStatus": "affected",
"packageName": "virt:rhel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "8100020240314161907.e155f54d",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "affected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "17:9.0.0-10.el9_5.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm-ma",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_virtualization:8::el8"
],
"defaultStatus": "affected",
"packageName": "virt:av/qemu-kvm",
"product": "Red Hat Enterprise Linux 8 Advanced Virtualization",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Xiao Lei (Zhejiang University) for reporting this issue."
}
],
"datePublic": "2024-01-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory and send it to the wire, causing an information leak."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T18:20:08.475Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2024:2962",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2024:2962"
},
{
"name": "RHSA-2025:4492",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2025:4492"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2023-6693"
},
{
"name": "RHBZ#2254580",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254580"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-12-11T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2024-01-02T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-121: Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2023-6693",
"datePublished": "2024-01-02T09:15:08.280Z",
"dateReserved": "2023-12-11T17:20:44.491Z",
"dateUpdated": "2026-02-25T18:20:08.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-6340 (GCVE-0-2023-6340)
Vulnerability from cvelistv5 – Published: 2024-01-17 23:57 – Updated: 2025-06-11 16:40
VLAI
EPSS
VEX
Summary
SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SN… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SonicWall | Capture Client |
Affected:
3.7.10 and earlier versions
|
|
| SonicWall | NetExtender |
Affected:
10.2.337 and earlier versions
|
Date Public
2024-01-17 07:27
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:28:21.581Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0019"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-6340",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-30T15:23:04.082962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-11T16:40:22.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows"
],
"product": "Capture Client",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "3.7.10 and earlier versions"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"64 bit",
"32 bit"
],
"product": "NetExtender",
"vendor": "SonicWall",
"versions": [
{
"status": "affected",
"version": "10.2.337 and earlier versions"
}
]
}
],
"datePublic": "2024-01-17T07:27:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SonicWall Capture Client version 3.7.10,\u0026nbsp;NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability."
}
],
"value": "SonicWall Capture Client version 3.7.10,\u00a0NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-17T23:57:06.142Z",
"orgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"shortName": "sonicwall"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0019"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "44b2ff79-1416-4492-88bb-ed0da00c7315",
"assignerShortName": "sonicwall",
"cveId": "CVE-2023-6340",
"datePublished": "2024-01-17T23:57:06.142Z",
"dateReserved": "2023-11-27T22:23:00.404Z",
"dateUpdated": "2025-06-11T16:40:22.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6322 (GCVE-0-2023-6322)
Vulnerability from cvelistv5 – Published: 2024-05-15 12:08 – Updated: 2024-08-02 08:28
VLAI
EPSS
VEX
Title
Stack-based buffer overflow in message parser functionality
Summary
A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Roku | Indoor Camera SE |
Affected:
0 , ≤ 3.0.2.4679
(custom)
|
|
| Wyze | Cam v3 |
Affected:
0 , ≤ 4.36.11.5859
(custom)
|
|
| wyze | cam_v3 |
Affected:
-
cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:* |
|
| roku | indoor_camera_se |
Affected:
-
cpe:2.3:h:roku:indoor_camera_se:-:*:*:*:*:*:*:* |
Date Public
2024-05-15 12:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wyze:cam_v3:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cam_v3",
"vendor": "wyze",
"versions": [
{
"status": "affected",
"version": "-"
}
]
},
{
"cpes": [
"cpe:2.3:h:roku:indoor_camera_se:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "indoor_camera_se",
"vendor": "roku",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6322",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-15T14:26:05.292848Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:13.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:28:21.761Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Indoor Camera SE",
"vendor": "Roku",
"versions": [
{
"lessThanOrEqual": "3.0.2.4679",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cam v3",
"vendor": "Wyze",
"versions": [
{
"lessThanOrEqual": "4.36.11.5859",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexandru Lazar"
},
{
"lang": "en",
"type": "finder",
"value": "Radu Basaraba"
}
],
"datePublic": "2024-05-15T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eA stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability. \u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 - Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-15T12:08:24.069Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stack-based buffer overflow in message parser functionality",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2023-6322",
"datePublished": "2024-05-15T12:08:24.069Z",
"dateReserved": "2023-11-27T14:22:34.488Z",
"dateUpdated": "2024-08-02T08:28:21.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6116 (GCVE-0-2023-6116)
Vulnerability from cvelistv5 – Published: 2024-04-26 07:23 – Updated: 2024-08-02 08:21
VLAI
EPSS
VEX
Title
Remote Code Execution without authentication using stack overflow
Summary
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the camera. An attacker could inject malicious into http request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Severity
8.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hanwha Vision Co., Ltd. | XRN-420S |
Affected:
5.01.52 and prior versions
|
|
| hanwhavision | xrn-420s |
Affected:
-
cpe:2.3:a:hanwhavision:xrn-420s:5.01.52:*:*:*:*:*:*:* |
Date Public
2024-04-26 07:20
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:hanwhavision:xrn-420s:5.01.52:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xrn-420s",
"vendor": "hanwhavision",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-26T13:16:56.098871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:01.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:21:17.445Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hanwhavision.com/wp-content/uploads/2024/04/NVR-DVR-Vulnerability-Report-CVE-2023-6116.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XRN-420S",
"vendor": "Hanwha Vision Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "5.01.52 and prior versions"
}
]
}
],
"datePublic": "2024-04-26T07:20:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cdiv\u003e\u003cdiv\u003eTeam ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the camera. An attacker could inject malicious into http request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer\u0027s report for details and workarounds.\u003c/div\u003e\u003c/div\u003e\n\n"
}
],
"value": "\nTeam ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the camera. An attacker could inject malicious into http request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer\u0027s report for details and workarounds.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-26T07:23:18.351Z",
"orgId": "fc9afe74-3f80-4fb7-a313-e6f036a89882",
"shortName": "Hanwha_Vision"
},
"references": [
{
"url": "https://www.hanwhavision.com/wp-content/uploads/2024/04/NVR-DVR-Vulnerability-Report-CVE-2023-6116.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution without authentication using stack overflow",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "fc9afe74-3f80-4fb7-a313-e6f036a89882",
"assignerShortName": "Hanwha_Vision",
"cveId": "CVE-2023-6116",
"datePublished": "2024-04-26T07:23:18.351Z",
"dateReserved": "2023-11-14T01:15:13.965Z",
"dateUpdated": "2024-08-02T08:21:17.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6095 (GCVE-0-2023-6095)
Vulnerability from cvelistv5 – Published: 2024-04-26 07:09 – Updated: 2024-08-02 08:21
VLAI
EPSS
VEX
Title
Remote Code Execution without authentication using memory overflow
Summary
Vladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP headers into request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Severity
8.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Hanwha Vision Co., Ltd. | HRX-1620 |
Affected:
3.05.62 and prior versions
|
|
| hanwhavision | ane-l6012r |
Affected:
-
cpe:2.3:h:hanwhavision:ane-l6012r:-:*:*:*:*:*:*:* |
Date Public
2024-04-26 06:59
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:hanwhavision:ane-l6012r:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ane-l6012r",
"vendor": "hanwhavision",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6095",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-30T15:33:48.703590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:17:21.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:21:17.058Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hanwhavision.com/wp-content/uploads/2024/04/NVR-DVR-Vulnerability-Report-CVE-2023-6095-6096.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HRX-1620",
"vendor": "Hanwha Vision Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "3.05.62 and prior versions"
}
]
}
],
"datePublic": "2024-04-26T06:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cdiv\u003e\u003cdiv\u003eVladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP headers into request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer\u0027s report for details and workarounds.\u003c/div\u003e\u003c/div\u003e\n\n"
}
],
"value": "\nVladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP headers into request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer\u0027s report for details and workarounds.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-26T07:09:38.940Z",
"orgId": "fc9afe74-3f80-4fb7-a313-e6f036a89882",
"shortName": "Hanwha_Vision"
},
"references": [
{
"url": "https://www.hanwhavision.com/wp-content/uploads/2024/04/NVR-DVR-Vulnerability-Report-CVE-2023-6095-6096.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution without authentication using memory overflow",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "fc9afe74-3f80-4fb7-a313-e6f036a89882",
"assignerShortName": "Hanwha_Vision",
"cveId": "CVE-2023-6095",
"datePublished": "2024-04-26T07:09:38.940Z",
"dateReserved": "2023-11-13T09:04:20.301Z",
"dateUpdated": "2024-08-02T08:21:17.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5944 (GCVE-0-2023-5944)
Vulnerability from cvelistv5 – Published: 2023-12-04 23:08 – Updated: 2024-08-02 08:14 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Delta Electronics DOPSoft Stack-based Buffer Overflow
Summary
Delta Electronics DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.
Severity
7.8 (High)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Delta Electronics | DOPSoft |
Affected:
All versions
|
Date Public
2023-11-30 18:41
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:14:25.147Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-01"
},
{
"tags": [
"x_transferred"
],
"url": "https://diastudio.deltaww.com/home/downloads?sec=download#catalog"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DOPSoft",
"vendor": "Delta Electronics",
"versions": [
{
"status": "affected",
"version": "All versions "
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Natnael Samson working with Trend Micro Zero Day"
}
],
"datePublic": "2023-11-30T18:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDelta Electronics\u0026nbsp;DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.\u003c/span\u003e\n\n"
}
],
"value": "\nDelta Electronics\u00a0DOPSoft is vulnerable to a stack-based buffer overflow, which may allow for arbitrary code execution if an attacker can lead a legitimate user to execute a specially crafted file.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-04T23:08:48.592Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-01"
},
{
"url": "https://diastudio.deltaww.com/home/downloads?sec=download#catalog"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003e\nDelta Electronics has declared DOPSoft as end-of-life and recommends users to use DIAScreen instead. \n\n\n\nThis vulnerability does not exist on the newest version of DIAScreen.\u0026nbsp; Users may download the DIAScreen v1.3.1 (or newer) on the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://diastudio.deltaww.com/home/downloads?sec=download#catalog\"\u003eDIAStudio download center\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "\n\nDelta Electronics has declared DOPSoft as end-of-life and recommends users to use DIAScreen instead. \n\n\n\nThis vulnerability does not exist on the newest version of DIAScreen.\u00a0 Users may download the DIAScreen v1.3.1 (or newer) on the DIAStudio download center https://diastudio.deltaww.com/home/downloads \n\n\n\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"unsupported-when-assigned"
],
"title": "Delta Electronics DOPSoft Stack-based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-5944",
"datePublished": "2023-12-04T23:08:48.592Z",
"dateReserved": "2023-11-02T22:30:47.777Z",
"dateUpdated": "2024-08-02T08:14:25.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5407 (GCVE-0-2023-5407)
Vulnerability from cvelistv5 – Published: 2024-04-17 16:49 – Updated: 2024-08-08 15:49
VLAI
EPSS
VEX
Summary
Controller denial of service due to improper handling of a specially crafted message received by the controller.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.482Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-24T14:30:38.880683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T15:49:07.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF1",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "510.2 HF14",
"status": "unaffected"
}
],
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller denial of service due to improper handling of a specially crafted message received by the controller.\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u003c/span\u003e"
}
],
"value": "Controller denial of service due to improper handling of a specially crafted message received by the controller.\n\nSee Honeywell Security Notification for recommendations on upgrading and versioning."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T19:38:30.357Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5407",
"datePublished": "2024-04-17T16:49:16.900Z",
"dateReserved": "2023-10-04T17:50:55.299Z",
"dateUpdated": "2024-08-08T15:49:07.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5403 (GCVE-0-2023-5403)
Vulnerability from cvelistv5 – Published: 2024-04-17 16:43 – Updated: 2024-08-29 19:38
VLAI
EPSS
VEX
Summary
Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
|
| honeywell | experion_server |
Affected:
511.5tcu4hf3 , ≤ 20.2tcu4hfr2
(semver)
Affected: 510.1 , ≤ 510.2_hf13 (semver) Affected: 520.1 , ≤ 520.1_tcu4 (semver) Affected: 511.1 , ≤ 511.5_tcu4_hf3 (semver) Affected: 520.2 , ≤ 520.2_tcu4 (semver) cpe:2.3:a:honeywell:experion_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:honeywell:experion_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "experion_server",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "20.2tcu4hfr2",
"status": "affected",
"version": "511.5tcu4hf3",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2_hf13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1_tcu4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5_tcu4_hf3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2_tcu4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T13:43:42.943158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-29T19:38:53.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure.\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u003c/span\u003e\n\n"
}
],
"value": "Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure.\n\nSee Honeywell Security Notification for recommendations on upgrading and versioning.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-25T17:00:27.977Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5403",
"datePublished": "2024-04-17T16:43:54.036Z",
"dateReserved": "2023-10-04T17:50:52.659Z",
"dateUpdated": "2024-08-29T19:38:53.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5401 (GCVE-0-2023-5401)
Vulnerability from cvelistv5 – Published: 2024-04-17 16:42 – Updated: 2024-08-02 07:59
VLAI
EPSS
VEX
Summary
Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
|
| honeywell | experion_server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) cpe:2.3:a:honeywell:experion_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:honeywell:experion_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "experion_server",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-31T14:00:59.742038Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T15:07:20.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.782Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u003c/span\u003e\n\n"
}
],
"value": "Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-47",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-47"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-25T16:59:37.083Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5401",
"datePublished": "2024-04-17T16:42:00.403Z",
"dateReserved": "2023-10-04T17:50:52.064Z",
"dateUpdated": "2024-08-02T07:59:44.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5395 (GCVE-0-2023-5395)
Vulnerability from cvelistv5 – Published: 2024-04-17 16:37 – Updated: 2024-08-02 07:59
VLAI
EPSS
VEX
Summary
Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | Experion Server |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
|
| honeywell | experion_server |
Affected:
520.2 , ≤ 520.2_tcu4
(semver)
cpe:2.3:a:honeywell:experion_server:520.2:*:*:*:*:*:*:* |
|
| honeywell | experion_server |
Affected:
510.1 , ≤ 510.2_hf13
(semver)
cpe:2.3:a:honeywell:experion_server:510.1:*:*:*:*:*:*:* |
|
| honeywell | experion_server |
Affected:
520.1 , ≤ 520.1_tcu4
(custom)
cpe:2.3:a:honeywell:experion_server:520.1:*:*:*:*:*:*:* |
|
| honeywell | experion_server |
Affected:
511.1 , ≤ 511.5_tcu4_hf3
(custom)
cpe:2.3:a:honeywell:experion_server:511.1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:honeywell:experion_server:520.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "experion_server",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.2_tcu4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:honeywell:experion_server:510.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "experion_server",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "510.2_hf13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:honeywell:experion_server:520.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "experion_server",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.1_tcu4",
"status": "affected",
"version": "520.1",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:honeywell:experion_server:511.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "experion_server",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "511.5_tcu4_hf3",
"status": "affected",
"version": "511.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-23T18:42:52.918169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T18:58:46.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.353Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF1",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "510.2 HF14",
"status": "unaffected"
}
],
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "Experion Server",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u003c/span\u003e\n\n"
}
],
"value": "Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote code execution.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-25T16:56:40.621Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5395",
"datePublished": "2024-04-17T16:37:00.868Z",
"dateReserved": "2023-10-04T17:50:47.748Z",
"dateUpdated": "2024-08-02T07:59:44.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-10
Operation
Build and Compilation
Strategy: Environment Hardening
- Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
- D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
Mitigation
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Mitigation
Implementation
Implement and perform bounds checking on input.
Mitigation
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
Mitigation MIT-11
Operation
Build and Compilation
Strategy: Environment Hardening
- Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
- Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
- For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
No CAPEC attack patterns related to this CWE.