Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
. Was ZDI-CAN-18412.
The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user.
. Was ZDI-CAN-18412.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Honeywell |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-56311 | Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. . Was ZDI-CAN-18412. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1848/ |
|
History
Wed, 12 Mar 2025 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:honeywell:saia_pg5_controls_suite:2.3.193:*:*:*:*:*:*:* | |
| Metrics |
cvssV3_1
|
Thu, 19 Sep 2024 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Honeywell
Honeywell saia Pg5 Controls Suite |
|
| CPEs | cpe:2.3:a:honeywell:saia_pg5_controls_suite:-:*:*:*:*:*:*:* | |
| Vendors & Products |
Honeywell
Honeywell saia Pg5 Controls Suite |
|
| Metrics |
ssvc
|
Wed, 18 Sep 2024 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-18412. | Honeywell Saia PG5 Controls Suite Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ZIP files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. . Was ZDI-CAN-18412. |
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2024-09-18T18:30:44.132Z
Reserved: 2023-12-20T21:52:34.954Z
Link: CVE-2023-51599
Vulnrichment
Updated: 2024-08-02T22:40:33.795Z
NVD
Status : Analyzed
Published: 2024-05-03T03:16:21.033
Modified: 2025-03-12T13:43:56.767
Link: CVE-2023-51599
Redhat
No data.
OpenCVE Enrichment
No data.