Unscored severity · published Jul 24, 2014
CVE-2014-2717
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass…
–
CVSS
3.7%
EPSS
No
On KEV
Description
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FX
Falcon Xlweb Linux Controller · Honeywell
through 2.04.01 · source: NVD
FX
Falcon Xlweb Xlwebexe · Honeywell
through 2.02.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2717
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2717
Third Party Advisory
http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01
More from Falcon Xlweb Linux Controller
–
CVE-2014-3110
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and…