PT-2024-14805 · Honeywell · Honeywell C300

Published 2024-04-17 · Updated 2024-07-09 · CVE-2023-5407

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Honeywell C300 (affected versions not specified)

Description The issue is related to a denial of service due to improper handling of a specially crafted message received by the controller. This can be exploited remotely. There is a critical stack-based buffer overflow vulnerability. It is recommended to review network logs for signs of compromise and limit external access to the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider limiting external access to the system to minimize the risk of exploitation. Restrict access to the Message Handler module to minimize the risk of exploitation. Review network logs for signs of compromise.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2023-5407

Affected Products

Honeywell C300

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-5407 · Security Note
• https://twitter.com/oktsec/status/1780698461979164696 · Twitter Post
• https://t.me/cvenotify/85615 · Telegram Post
• https://t.me/cvenotify/77159 · Telegram Post
• https://process.honeywell.com · Note
• https://twitter.com/VulmonFeeds/status/1780670598579880380 · Twitter Post
• https://twitter.com/CVEnew/status/1780651881238274312 · Twitter Post
• https://t.me/cvenotify/77215 · Telegram Post