by Kastro
Paper/Archive/CVE-2023-25178

CVE-2023-25178

Honeywell C300 — Controller design flaw - unsigned firmware

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.2.442 × 208.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected

ProductAffectedFixed inSource
C300501.1 – 501.6HF8–CNA
C300510.1 – 510.2HF12–CNA
C300511.1 – 511.5TCU3–CNA
C300520.1 – 520.1TCU4–CNA
C300520.2 – 520.2TCU2–CNA
C300510.1 – 511.5TCU3–CNA
C300520.1 – 520.1TCU4–CNA
C300520.2 – 520.2TCU2–CNA

Scores by source

Honeywell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refprocess.honeywell.com