github - ghsa-qj3p-g2m7-rx94

GHSA-QJ3P-G2M7-RX94

Vulnerability from github – Published: 2024-01-31 18:31 – Updated: 2024-07-09 21:30

Details

An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-5390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-36"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-31T18:15:46Z",
    "severity": "MODERATE"
  },
  "details": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n\n",
  "id": "GHSA-qj3p-g2m7-rx94",
  "modified": "2024-07-09T21:30:34Z",
  "published": "2024-01-31T18:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5390"
    },
    {
      "type": "WEB",
      "url": "https://process.honeywell.com"
    },
    {
      "type": "WEB",
      "url": "https://www.honeywell.com/us/en/product-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-5390 (GCVE-0-2023-5390)

Vulnerability from cvelistv5 – Published: 2024-01-31 17:46 – Updated: 2025-05-29 15:03

Summary

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-36

Assigner

Honeywell

References

URL

Tags

	https://process.honeywell.com
	https://www.honeywell.com/us/en/product-security

Impacted products

Vendor

Product

Version

Honeywell

ControlEdge UOC

Affected: 520.2 , ≤ 520.2 TCU4 (semver)
Affected: 510.1 , ≤ 510.2 HF13 (semver)
Affected: 520.1 , ≤ 520.1 TCU4 (semver)
Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver)

	Honeywell	ControlEdge UOC	Affected: 520.2 , ≤ 520.2 TCU4 (semver) Affected: 511.1 , ≤ 511.5 TCU4 HF3 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver)
	Honeywell	ControlEdge UOC	Affected: 520.2 , ≤ 520.2 TCU4 (semver) Affected: 520.1 , ≤ 520.1 TCU4 (semver) Affected: 520.2 TCU4 HFR2 , ≤ 511.5 TCU4 HF3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:59:44.316Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://process.honeywell.com"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.honeywell.com/us/en/product-security"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5390",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:42:27.845224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:03:38.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion PKS"
          ],
          "product": "ControlEdge UOC",
          "vendor": "Honeywell",
          "versions": [
            {
              "changes": [
                {
                  "at": "520.2 TCU4 HF1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "520.2 TCU4",
              "status": "affected",
              "version": "520.2",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "510.2 HF14",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "510.2 HF13",
              "status": "affected",
              "version": "510.1",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "520.1 TCU5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "520.1 TCU4",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "511.5 TCU4 HF4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "511.5 TCU4 HF3",
              "status": "affected",
              "version": "511.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Experion LX"
          ],
          "product": "ControlEdge UOC",
          "vendor": "Honeywell",
          "versions": [
            {
              "changes": [
                {
                  "at": "520.2 TCU4 HF2",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "520.2 TCU4",
              "status": "affected",
              "version": "520.2",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "511.5 TCU4 HF4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "511.5 TCU4 HF3",
              "status": "affected",
              "version": "511.1",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "520.1 TCU5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "520.1 TCU4",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "PlantCruise by Experion"
          ],
          "product": "ControlEdge UOC",
          "vendor": "Honeywell",
          "versions": [
            {
              "changes": [
                {
                  "at": "520.2 TCU4 HF2",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "520.2 TCU4",
              "status": "affected",
              "version": "520.2",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "520.1 TCU5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "520.1 TCU4",
              "status": "affected",
              "version": "520.1",
              "versionType": "semver"
            },
            {
              "changes": [
                {
                  "at": "511.5 TCU4 HF4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "511.5 TCU4 HF3",
              "status": "affected",
              "version": "520.2 TCU4 HFR2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u0026nbsp;See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n\u003cbr\u003e"
            }
          ],
          "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-36",
              "description": "CWE-36",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-09T19:56:46.965Z",
        "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
        "shortName": "Honeywell"
      },
      "references": [
        {
          "url": "https://process.honeywell.com"
        },
        {
          "url": "https://www.honeywell.com/us/en/product-security"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
    "assignerShortName": "Honeywell",
    "cveId": "CVE-2023-5390",
    "datePublished": "2024-01-31T17:46:39.809Z",
    "dateReserved": "2023-10-04T17:50:05.792Z",
    "dateUpdated": "2025-05-29T15:03:38.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-QJ3P-G2M7-RX94

CVE-2023-5390 (GCVE-0-2023-5390)

Tags

Sightings

Nomenclature