by Kastro
Paper/Archive/CVE-2023-3710

CVE-2023-3710

Honeywell PM23/43 — Printer web page invalid command execution

EPSS 49%CVSS 9.9
critical.is priorityof 100
50
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).

Affected

ProductAffectedFixed inSource
PM23/43< P10.19.050004P10.19.050004CNA
PC23/43, PD43< K10.19.050004K10.19.050004CNA
PM42< T10.19.050004T10.19.050004CNA
PM42< L10.19.050004L10.19.050004CNA
PX4ie/6ie< A10.19.050004A10.19.050004CNA
PX45/65< B10.19.050004B10.19.050004CNA
PD45, PX240< F10.19.050004F10.19.050004CNA
PX940< H10.19.050004H10.19.050004CNA
PM45< J10.19.050004J10.19.050004CNA
RP2f/RP4f< M10.19.050006M10.19.050006CNA
pm23_43< P10.19.050004P10.19.050004CISA-ADP
pc23_43< K10.19.050004K10.19.050004CISA-ADP

Scores by source

Honeywell (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refhoneywell.com/us/en/product-securityrefhsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004refhsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A