CVE-2023-5390 - OpenCVE

An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Honeywell	Controledge Virtual Unit Operations Controller Controledge Virtual Unit Operations Controller Firmware Controledge Unit Operations Controller Firmware Controledge Unit Operations Controller

Configuration 1 [-]

AND

cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*

References

Link	Resource
https://process.honeywell.com	Product
https://www.honeywell.com/us/en/product-security	Not Applicable

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Honeywell

Published: 2024-01-31T17:46:39.809Z

Updated: 2024-07-09T19:56:46.965Z

Reserved: 2023-10-04T17:50:05.792Z

Link: CVE-2023-5390

JSON object: View

NVD Information

Status : Analyzed

Published: 2024-01-31T18:15:46.780

Modified: 2024-02-08T17:18:46.787

Link: CVE-2023-5390

JSON object: View

Redhat Information

No data.

CWE

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5390", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2023-10-04T17:50:05.792Z", "datePublished": "2024-01-31T17:46:39.809Z", "dateUpdated": "2024-07-09T19:56:46.965Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Experion PKS"], "product": "ControlEdge UOC", "vendor": "Honeywell", "versions": [{"changes": [{"at": "520.2 TCU4 HF1", "status": "unaffected"}], "lessThanOrEqual": "520.2 TCU4", "status": "affected", "version": "520.2", "versionType": "semver"}, {"changes": [{"at": "510.2 HF14", "status": "unaffected"}], "lessThanOrEqual": "510.2 HF13", "status": "affected", "version": "510.1", "versionType": "semver"}, {"changes": [{"at": "520.1 TCU5", "status": "unaffected"}], "lessThanOrEqual": "520.1 TCU4", "status": "affected", "version": "520.1", "versionType": "semver"}, {"changes": [{"at": "511.5 TCU4 HF4", "status": "unaffected"}], "lessThanOrEqual": "511.5 TCU4 HF3", "status": "affected", "version": "511.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Experion LX"], "product": "ControlEdge UOC", "vendor": "Honeywell", "versions": [{"changes": [{"at": "520.2 TCU4 HF2", "status": "unaffected"}], "lessThanOrEqual": "520.2 TCU4", "status": "affected", "version": "520.2", "versionType": "semver"}, {"changes": [{"at": "511.5 TCU4 HF4", "status": "unaffected"}], "lessThanOrEqual": "511.5 TCU4 HF3", "status": "affected", "version": "511.1", "versionType": "semver"}, {"changes": [{"at": "520.1 TCU5", "status": "unaffected"}], "lessThanOrEqual": "520.1 TCU4", "status": "affected", "version": "520.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["PlantCruise by Experion"], "product": "ControlEdge UOC", "vendor": "Honeywell", "versions": [{"changes": [{"at": "520.2 TCU4 HF2", "status": "unaffected"}], "lessThanOrEqual": "520.2 TCU4", "status": "affected", "version": "520.2", "versionType": "semver"}, {"changes": [{"at": "520.1 TCU5", "status": "unaffected"}], "lessThanOrEqual": "520.1 TCU4", "status": "affected", "version": "520.1", "versionType": "semver"}, {"changes": [{"at": "511.5 TCU4 HF4", "status": "unaffected"}], "lessThanOrEqual": "511.5 TCU4 HF3", "status": "affected", "version": "520.2 TCU4 HFR2", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n<br>"}], "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-36", "description": "CWE-36", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2024-07-09T19:56:46.965Z"}, "references": [{"url": "https://process.honeywell.com"}, {"url": "https://www.honeywell.com/us/en/product-security"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B528F553-0D96-4A1D-9ABE-DA9555534BB2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "E30EFCB6-6534-46EE-A743-2218FD0DAA81", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "67C0BF18-A928-4A47-A71E-2216BE4ECB90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "F436C92C-7EED-44A5-B53D-12B54652D0A1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n\n"}, {"lang": "es", "value": "Un atacante podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la lectura de archivos desde Honeywell Experion ControlEdge VirtualUOC y ControlEdge UOC. Esta explotaci\u00f3n podr\u00eda usarse para leer archivos del controlador que pueden exponer informaci\u00f3n limitada del dispositivo. Honeywell recomienda actualizar a la versi\u00f3n m\u00e1s reciente del producto. Consulte la Notificaci\u00f3n de seguridad de Honeywell para obtener recomendaciones sobre actualizaci\u00f3n y control de versiones."}], "id": "CVE-2023-5390", "lastModified": "2024-02-08T17:18:46.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@honeywell.com", "type": "Secondary"}]}, "published": "2024-01-31T18:15:46.780", "references": [{"source": "psirt@honeywell.com", "tags": ["Product"], "url": "https://process.honeywell.com"}, {"source": "psirt@honeywell.com", "tags": ["Not Applicable"], "url": "https://www.honeywell.com/us/en/product-security"}], "sourceIdentifier": "psirt@honeywell.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-36"}], "source": "psirt@honeywell.com", "type": "Secondary"}]}