CVE-2023-25948

Summary

Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected Software

VendorProductVersion RangeStatus
HoneywellExperion Server501.1 <= 501.6HF8affected
HoneywellExperion Server510.1 <= 510.2HF12affected
HoneywellExperion Server511.1 <= 511.5TCU3affected
HoneywellExperion Server520.1 <= 520.1TCU4affected
HoneywellExperion Server520.2 <= 520.2TCU2affected
HoneywellExperion Station501.1 <= 501.6HF8affected
HoneywellExperion Station510.1 <= 510.2HF12affected
HoneywellExperion Station511.1 <= 511.5TCU3affected
HoneywellExperion Station520.1 <= 520.1TCU4affected
HoneywellExperion Station520.2 <= 520.2TCU2affected
HoneywellEngineering Station510.1 <= 511.5TCU3affected
HoneywellEngineering Station520.1 <= 520.1TCU4affected
HoneywellEngineering Station520.2 <= 520.2TCU2affected
HoneywellDirect Station510.5 <= 511.5TCU3affected
HoneywellDirect Station520.1 <= 520.1TCU4affected
HoneywellDirect Station520.2 <= 520.2TCU2affected

Weaknesses

  • CWE-394: CWE-394 Unexpected Status Code or Return Value

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References