PT-2024-1408 · Honeywell · Honeywell Experion Controledge Virtualuoc+1

Published

2024-01-30

·

Updated

2024-05-24

·

CVE-2023-5389

CVSS v2.0

9.4

Critical

VectorAV:N/AC:L/Au:N/C:N/I:C/A:C
Name of the Vulnerable Software and Affected Versions Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC (affected versions not specified)
Description The issue is related to the use of dangerous methods or functions in the Configuration Handler component of the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC software. An attacker could potentially exploit this vulnerability, leading to the ability to modify files, which may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered.
Recommendations Update to the most recent version of the product, following the recommendations provided in the Honeywell Security Notification for upgrading and versioning. As a temporary workaround, consider restricting access to the Configuration Handler component until a patch is available. Avoid using the vulnerable component for critical operations until the issue is resolved. At the moment, there is no information about a specific version that contains a fix for this vulnerability, so updating to the latest version is recommended.

Fix

Weakness Enumeration

CWE-749

Related Identifiers

BDU:2024-00879
CVE-2023-5389

Affected Products

Controledge Uoc
Honeywell Experion Controledge Virtualuoc