Critical severity · published Jul 13, 2023
CVE-2023-25178
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C300 Firmware · Honeywell
501.1 through 501.6hf8; 510.1 through 510.2hf12; 511.1 through 511.5tcu3; 520.1 through 520.1tcu4; 520.2 through 520.2tcu2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25178
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25178
Product
https://process.honeywell.com
More from C300 Firmware
10.0
CVE-2021-38397
Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
9.8
CVE-2021-38395
Honeywell Experion PKS and ACE Controllers Injection
7.5
CVE-2023-26597
Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on…
7.5
CVE-2023-25770
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on…
7.5
CVE-2023-24480
Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versioning