Search
Find a vulnerability
Search criteria
12 vulnerabilities found for c300 by honeywell
CVE-2023-5407 (GCVE-0-2023-5407)
Vulnerability from nvd – Published: 2024-04-17 16:49 – Updated: 2024-08-08 15:49
VLAI
EPSS
VEX
Summary
Controller denial of service due to improper handling of a specially crafted message received by the controller.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.482Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-24T14:30:38.880683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T15:49:07.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF1",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "510.2 HF14",
"status": "unaffected"
}
],
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller denial of service due to improper handling of a specially crafted message received by the controller.\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u003c/span\u003e"
}
],
"value": "Controller denial of service due to improper handling of a specially crafted message received by the controller.\n\nSee Honeywell Security Notification for recommendations on upgrading and versioning."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T19:38:30.357Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5407",
"datePublished": "2024-04-17T16:49:16.900Z",
"dateReserved": "2023-10-04T17:50:55.299Z",
"dateUpdated": "2024-08-08T15:49:07.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5392 (GCVE-0-2023-5392)
Vulnerability from nvd – Published: 2024-04-11 19:19 – Updated: 2024-08-02 07:59
VLAI
EPSS
VEX
Summary
C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
|
| honeywell | c300 |
Affected:
510.1 , ≤ 510.2_hf13
(semver)
Affected: 511.1 , ≤ 511.5_tcu4_hf3 (semver) Affected: 520.1 , ≤ 520.1_tcu4 (semver) Affected: 520.2 , ≤ 520.2_tcu4 (semver) Affected: 520.2_tcu4_hfr2 , ≤ 511.5_tcu4_hf3 (semver) cpe:2.3:h:honeywell:c300:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:honeywell:c300:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "510.2_hf13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5_tcu4_hf3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1_tcu4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2_tcu4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5_tcu4_hf3",
"status": "affected",
"version": "520.2_tcu4_hfr2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-08T18:49:08.032838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T20:14:06.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.280Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function.\u0026nbsp;Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"value": "C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function.\u00a0Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-121",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-121"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1295",
"description": "CWE-1295",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-25T16:53:35.336Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5392",
"datePublished": "2024-04-11T19:19:19.070Z",
"dateReserved": "2023-10-04T17:50:45.390Z",
"dateUpdated": "2024-08-02T07:59:44.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26597 (GCVE-0-2023-26597)
Vulnerability from nvd – Published: 2023-07-13 11:04 – Updated: 2025-03-05 18:50
VLAI
EPSS
VEX
Title
Controller DOS on sending error response
Summary
Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:53:53.803Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:38:43.280343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:50:22.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T16:01:10.959Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller DOS on sending error response",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-26597",
"datePublished": "2023-07-13T11:04:55.153Z",
"dateReserved": "2023-02-28T23:51:16.647Z",
"dateUpdated": "2025-03-05T18:50:22.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25770 (GCVE-0-2023-25770)
Vulnerability from nvd – Published: 2023-07-13 10:59 – Updated: 2024-08-02 11:32
VLAI
EPSS
VEX
Title
Controller stack overflow on decoding messages from the server
Summary
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| honeywell | c300 |
Affected:
501.1 , ≤ 501.6hf8
(semver)
cpe:2.3:h:honeywell:c300:501.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
510.1 , ≤ 510.2hf12
(semver)
cpe:2.3:h:honeywell:c300:510.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
511.1 , ≤ 511.5tcu3
(semver)
cpe:2.3:h:honeywell:c300:511.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
520.1 , ≤ 520.1tcu4
(semver)
cpe:2.3:h:honeywell:c300:520.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
520.2 , ≤ 520.2tcu2
(semver)
cpe:2.3:h:honeywell:c300:520.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:honeywell:c300:501.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "501.6hf8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:510.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "510.2hf12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:511.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "511.5tcu3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:520.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.1tcu4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:520.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.2tcu2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-22T18:26:04.535864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T19:15:35.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:32:12.419Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n"
}
],
"value": "Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-221",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-221 XML External Entities Blowup"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T16:03:06.413Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller stack overflow on decoding messages from the server",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-25770",
"datePublished": "2023-07-13T10:59:58.825Z",
"dateReserved": "2023-02-28T23:51:16.657Z",
"dateUpdated": "2024-08-02T11:32:12.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25178 (GCVE-0-2023-25178)
Vulnerability from nvd – Published: 2023-07-13 10:59 – Updated: 2025-03-05 18:50
VLAI
EPSS
VEX
Title
Controller design flaw - unsigned firmware
Summary
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:18:35.746Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:39:56.713815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:50:28.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller may be loaded with malicious firmware which could enable remote code execution.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n"
}
],
"value": "Controller may be loaded with malicious firmware which could enable remote code execution.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-638",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-638 Altered Component Firmware"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T16:03:44.238Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller design flaw - unsigned firmware",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-25178",
"datePublished": "2023-07-13T10:59:16.333Z",
"dateReserved": "2023-02-28T23:51:16.663Z",
"dateUpdated": "2025-03-05T18:50:28.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-24480 (GCVE-0-2023-24480)
Vulnerability from nvd – Published: 2023-07-13 10:57 – Updated: 2025-03-05 18:50
VLAI
EPSS
VEX
Title
Controller stack overflow when decoding messages from the server
Summary
Controller DoS due to stack overflow when decoding a message from the server.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:56:04.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-24480",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:39:59.649573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:50:43.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller DoS due to stack overflow when decoding a message from the server.\u0026nbsp;\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n"
}
],
"value": "Controller DoS due to stack overflow when decoding a message from the server.\u00a0\n\nSee Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-173",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-173 Action Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T15:59:10.657Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller stack overflow when decoding messages from the server",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-24480",
"datePublished": "2023-07-13T10:57:46.879Z",
"dateReserved": "2023-02-28T23:51:16.652Z",
"dateUpdated": "2025-03-05T18:50:43.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5407 (GCVE-0-2023-5407)
Vulnerability from cvelistv5 – Published: 2024-04-17 16:49 – Updated: 2024-08-08 15:49
VLAI
EPSS
VEX
Summary
Controller denial of service due to improper handling of a specially crafted message received by the controller.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.482Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5407",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-24T14:30:38.880683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-08T15:49:07.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF1",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "510.2 HF14",
"status": "unaffected"
}
],
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"changes": [
{
"at": "520.2 TCU4 HF2",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"changes": [
{
"at": "520.1 TCU5",
"status": "unaffected"
}
],
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"changes": [
{
"at": "511.5 TCU4 HF4",
"status": "unaffected"
}
],
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller denial of service due to improper handling of a specially crafted message received by the controller.\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u003c/span\u003e"
}
],
"value": "Controller denial of service due to improper handling of a specially crafted message received by the controller.\n\nSee Honeywell Security Notification for recommendations on upgrading and versioning."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T19:38:30.357Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5407",
"datePublished": "2024-04-17T16:49:16.900Z",
"dateReserved": "2023-10-04T17:50:55.299Z",
"dateUpdated": "2024-08-08T15:49:07.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5392 (GCVE-0-2023-5392)
Vulnerability from cvelistv5 – Published: 2024-04-11 19:19 – Updated: 2024-08-02 07:59
VLAI
EPSS
VEX
Summary
C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) |
|
| Honeywell | C300 |
Affected:
520.2 , ≤ 520.2 TCU4
(semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver) |
|
| honeywell | c300 |
Affected:
510.1 , ≤ 510.2_hf13
(semver)
Affected: 511.1 , ≤ 511.5_tcu4_hf3 (semver) Affected: 520.1 , ≤ 520.1_tcu4 (semver) Affected: 520.2 , ≤ 520.2_tcu4 (semver) Affected: 520.2_tcu4_hfr2 , ≤ 511.5_tcu4_hf3 (semver) cpe:2.3:h:honeywell:c300:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:honeywell:c300:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "510.2_hf13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5_tcu4_hf3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1_tcu4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2_tcu4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5_tcu4_hf3",
"status": "affected",
"version": "520.2_tcu4_hfr2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-5392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-08T18:49:08.032838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T20:14:06.723Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:59:44.280Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2 HF13",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"PlantCruise by Experion"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU4",
"status": "affected",
"version": "520.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1 TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5 TCU4 HF3",
"status": "affected",
"version": "520.2 TCU4 HFR2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function.\u0026nbsp;Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"value": "C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function.\u00a0Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-121",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-121"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1295",
"description": "CWE-1295",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-25T16:53:35.336Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-5392",
"datePublished": "2024-04-11T19:19:19.070Z",
"dateReserved": "2023-10-04T17:50:45.390Z",
"dateUpdated": "2024-08-02T07:59:44.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26597 (GCVE-0-2023-26597)
Vulnerability from cvelistv5 – Published: 2023-07-13 11:04 – Updated: 2025-03-05 18:50
VLAI
EPSS
VEX
Title
Controller DOS on sending error response
Summary
Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:53:53.803Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:38:43.280343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:50:22.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T16:01:10.959Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller DOS on sending error response",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-26597",
"datePublished": "2023-07-13T11:04:55.153Z",
"dateReserved": "2023-02-28T23:51:16.647Z",
"dateUpdated": "2025-03-05T18:50:22.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25770 (GCVE-0-2023-25770)
Vulnerability from cvelistv5 – Published: 2023-07-13 10:59 – Updated: 2024-08-02 11:32
VLAI
EPSS
VEX
Title
Controller stack overflow on decoding messages from the server
Summary
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| honeywell | c300 |
Affected:
501.1 , ≤ 501.6hf8
(semver)
cpe:2.3:h:honeywell:c300:501.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
510.1 , ≤ 510.2hf12
(semver)
cpe:2.3:h:honeywell:c300:510.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
511.1 , ≤ 511.5tcu3
(semver)
cpe:2.3:h:honeywell:c300:511.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
520.1 , ≤ 520.1tcu4
(semver)
cpe:2.3:h:honeywell:c300:520.1:*:*:*:*:*:*:* |
|
| honeywell | c300 |
Affected:
520.2 , ≤ 520.2tcu2
(semver)
cpe:2.3:h:honeywell:c300:520.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:honeywell:c300:501.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "501.6hf8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:510.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "510.2hf12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:511.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "511.5tcu3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:520.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.1tcu4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:h:honeywell:c300:520.2:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "c300",
"vendor": "honeywell",
"versions": [
{
"lessThanOrEqual": "520.2tcu2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25770",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-22T18:26:04.535864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-08T19:15:35.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:32:12.419Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n"
}
],
"value": "Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-221",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-221 XML External Entities Blowup"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T16:03:06.413Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller stack overflow on decoding messages from the server",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-25770",
"datePublished": "2023-07-13T10:59:58.825Z",
"dateReserved": "2023-02-28T23:51:16.657Z",
"dateUpdated": "2024-08-02T11:32:12.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25178 (GCVE-0-2023-25178)
Vulnerability from cvelistv5 – Published: 2023-07-13 10:59 – Updated: 2025-03-05 18:50
VLAI
EPSS
VEX
Title
Controller design flaw - unsigned firmware
Summary
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:18:35.746Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:39:56.713815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:50:28.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller may be loaded with malicious firmware which could enable remote code execution.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n"
}
],
"value": "Controller may be loaded with malicious firmware which could enable remote code execution.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-638",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-638 Altered Component Firmware"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T16:03:44.238Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller design flaw - unsigned firmware",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-25178",
"datePublished": "2023-07-13T10:59:16.333Z",
"dateReserved": "2023-02-28T23:51:16.663Z",
"dateUpdated": "2025-03-05T18:50:28.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-24480 (GCVE-0-2023-24480)
Vulnerability from cvelistv5 – Published: 2023-07-13 10:57 – Updated: 2025-03-05 18:50
VLAI
EPSS
VEX
Title
Controller stack overflow when decoding messages from the server
Summary
Controller DoS due to stack overflow when decoding a message from the server.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 |
Affected:
501.1 , ≤ 501.6HF8
(semver)
Affected: 510.1 , ≤ 510.2HF12 (semver) Affected: 511.1 , ≤ 511.5TCU3 (semver) Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
|
| Honeywell | C300 |
Affected:
510.1 , ≤ 511.5TCU3
(semver)
Affected: 520.1 , ≤ 520.1TCU4 (semver) Affected: 520.2 , ≤ 520.2TCU2 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:56:04.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://process.honeywell.com"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-24480",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:39:59.649573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:50:43.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "501.6HF8",
"status": "affected",
"version": "501.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "510.2HF12",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "511.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion LX",
"Experion PlantCruise"
],
"product": "C300",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "511.5TCU3",
"status": "affected",
"version": "510.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.1TCU4",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "520.2TCU2",
"status": "affected",
"version": "520.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Controller DoS due to stack overflow when decoding a message from the server.\u0026nbsp;\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSee Honeywell Security Notification for recommendations on upgrading and versioning. \u003c/span\u003e\n\n"
}
],
"value": "Controller DoS due to stack overflow when decoding a message from the server.\u00a0\n\nSee Honeywell Security Notification for recommendations on upgrading and versioning. \n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-173",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-173 Action Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-22T15:59:10.657Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Controller stack overflow when decoding messages from the server",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2023-24480",
"datePublished": "2023-07-13T10:57:46.879Z",
"dateReserved": "2023-02-28T23:51:16.652Z",
"dateUpdated": "2025-03-05T18:50:43.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}