PT-2017-9624 · Honeywell · Honeywell Experion Process Knowledge System

Published 2017-02-13 · Updated 2019-04-09 · CVE-2016-8344

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Honeywell Experion Process Knowledge System (PKS) versions Release 3xx and prior, Release 400, Release 410, Release 430, Release 431

Description The issue is related to improper input validation in the Experion PKS platform. An attacker can send a specially crafted packet to cause the process to terminate, which would prevent firmware uploads to the Series-C devices.

Recommendations For versions Release 3xx and prior, Release 400, Release 410, Release 430, Release 431, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-8344

Affected Products

Honeywell Experion Process Knowledge System

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8344 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8344 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-16-301-01 · Note
• http://securityfocus.com/bid/93950 · Note