by Kastro
Paper/Archive/CVE-2023-25770

CVE-2023-25770

Honeywell C300 — Controller stack overflow on decoding messages from the server

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.4.534 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected

ProductAffectedFixed inSource
C300501.1 – 501.6HF8–CNA
C300510.1 – 510.2HF12–CNA
C300511.1 – 511.5TCU3–CNA
C300520.1 – 520.1TCU4–CNA
C300520.2 – 520.2TCU2–CNA
C300510.1 – 511.5TCU3–CNA
C300520.1 – 520.1TCU4–CNA
C300520.2 – 520.2TCU2–CNA
c300501.1 – 501.6hf8–CISA-ADP
c300510.1 – 510.2hf12–CISA-ADP
c300511.1 – 511.5tcu3–CISA-ADP
c300520.1 – 520.1tcu4–CISA-ADP

Scores by source

Honeywell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refprocess.honeywell.com