Unscored severity · published Jul 24, 2014
CVE-2014-3110
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and…
–
CVSS
5.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FX
Falcon Xlweb Linux Controller · Honeywell
through 2.04.01 · source: NVD
FX
Falcon Xlweb Xlwebexe · Honeywell
through 2.02.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3110
Third Party Advisory
http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01
www.securityfocus.com
http://www.securityfocus.com/bid/68838
www.exploit-db.com
https://www.exploit-db.com/exploits/44749/
More from Falcon Xlweb Linux Controller
–
CVE-2014-2717
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass…