CVE-2023-25078

Summary

Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation. 

See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected Software

VendorProductVersion RangeStatus
HoneywellExperion Server501.1 <= 501.6HF8affected
HoneywellExperion Server510.1 <= 510.2HF12affected
HoneywellExperion Server511.1 <= 511.5TCU3affected
HoneywellExperion Server520.1 <= 520.1TCU4affected
HoneywellExperion Server520.2 <= 520.2TCU2affected
HoneywellExperion Station501.1 <= 501.6HF8affected
HoneywellExperion Station510.1 <= 510.2HF12affected
HoneywellExperion Station511.1 <= 511.5TCU3affected
HoneywellExperion Station520.1 <= 520.1TCU4affected
HoneywellExperion Station520.2 <= 520.2TCU2affected
HoneywellEngineering Station510.1 <= 511.5TCU3affected
HoneywellEngineering Station520.1 <= 520.1TCU4affected
HoneywellEngineering Station520.2 <= 520.2TCU2affected
HoneywellDirect Station510.5 <= 511.5TCU3affected
HoneywellDirect Station520.1 <= 520.1TCU4affected
HoneywellDirect Station520.2 <= 520.2TCU2affected

Weaknesses

  • CWE-787: CWE-787 Out-of-bounds Write

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: total

References