Critical severity · published Mar 25, 2019
CVE-2014-9189
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to…
9.8
CVSS
5.2%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Experion Process Knowledge System · Honeywell
r400 before r400.6; r410 before r410.6; r430 before r430.2 · source: NVD
Affected product
EP
Experion Process Knowledge System
Honeywell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9189
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-14-352-01
More from Experion Process Knowledge System
9.8
CVE-2014-9186
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to…
9.8
CVE-2014-5435
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could…
9.8
CVE-2014-9187
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2…
7.5
CVE-2014-5436
A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to…
3.7
CVE-2016-8344
An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410,…