by Kastro
Paper/Archive/CVE-2023-5389

CVE-2023-5389

Honeywell ControlEdge UOC — An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge Virtua…

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected

ProductAffectedFixed inSource
ControlEdge UOC520.2 – 520.2 TCU4–CNA
ControlEdge UOC510.1 – 510.2 HF13–CNA
ControlEdge UOC520.1 – 520.1 TCU4–CNA
ControlEdge UOC511.1 – 511.5 TCU4 HF3–CNA
ControlEdge UOC520.2 – 520.2 TCU4–CNA
ControlEdge UOC511.1 – 511.5 TCU4 HF3–CNA
ControlEdge UOC520.1 – 520.1 TCU4–CNA
ControlEdge UOC520.2 – 520.2 TCU4–CNA
ControlEdge UOC520.1 – 520.1 TCU4–CNA
ControlEdge UOC520.2 TCU4 HFR2 – 511.5 TCU4 HF3–CNA

Scores by source

Honeywell (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refprocess.honeywell.comrefhoneywell.com/us/en/product-security