CVE-2023-5390 - OpenCVE

An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Honeywell	Controledge Unit Operations Controller Controledge Unit Operations Controller Firmware Controledge Virtual Unit Operations Controller Controledge Virtual Unit Operations Controller Firmware

Configuration 1 [-]

AND

cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://process.honeywell.com
https://www.honeywell.com/us/en/product-security

History

No history.

MITRE

Status: PUBLISHED

Assigner: Honeywell

Published: 2024-01-31T17:46:39.809Z

Updated: 2024-08-02T07:59:44.316Z

Reserved: 2023-10-04T17:50:05.792Z

Link: CVE-2023-5390

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-01-31T18:15:46.780

Modified: 2024-07-09T20:15:08.647

Link: CVE-2023-5390

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5390", "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "state": "PUBLISHED", "assignerShortName": "Honeywell", "dateReserved": "2023-10-04T17:50:05.792Z", "datePublished": "2024-01-31T17:46:39.809Z", "dateUpdated": "2024-08-02T07:59:44.316Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Experion PKS"], "product": "ControlEdge UOC", "vendor": "Honeywell", "versions": [{"changes": [{"at": "520.2 TCU4 HF1", "status": "unaffected"}], "lessThanOrEqual": "520.2 TCU4", "status": "affected", "version": "520.2", "versionType": "semver"}, {"changes": [{"at": "510.2 HF14", "status": "unaffected"}], "lessThanOrEqual": "510.2 HF13", "status": "affected", "version": "510.1", "versionType": "semver"}, {"changes": [{"at": "520.1 TCU5", "status": "unaffected"}], "lessThanOrEqual": "520.1 TCU4", "status": "affected", "version": "520.1", "versionType": "semver"}, {"changes": [{"at": "511.5 TCU4 HF4", "status": "unaffected"}], "lessThanOrEqual": "511.5 TCU4 HF3", "status": "affected", "version": "511.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["Experion LX"], "product": "ControlEdge UOC", "vendor": "Honeywell", "versions": [{"changes": [{"at": "520.2 TCU4 HF2", "status": "unaffected"}], "lessThanOrEqual": "520.2 TCU4", "status": "affected", "version": "520.2", "versionType": "semver"}, {"changes": [{"at": "511.5 TCU4 HF4", "status": "unaffected"}], "lessThanOrEqual": "511.5 TCU4 HF3", "status": "affected", "version": "511.1", "versionType": "semver"}, {"changes": [{"at": "520.1 TCU5", "status": "unaffected"}], "lessThanOrEqual": "520.1 TCU4", "status": "affected", "version": "520.1", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["PlantCruise by Experion"], "product": "ControlEdge UOC", "vendor": "Honeywell", "versions": [{"changes": [{"at": "520.2 TCU4 HF2", "status": "unaffected"}], "lessThanOrEqual": "520.2 TCU4", "status": "affected", "version": "520.2", "versionType": "semver"}, {"changes": [{"at": "520.1 TCU5", "status": "unaffected"}], "lessThanOrEqual": "520.1 TCU4", "status": "affected", "version": "520.1", "versionType": "semver"}, {"changes": [{"at": "511.5 TCU4 HF4", "status": "unaffected"}], "lessThanOrEqual": "511.5 TCU4 HF3", "status": "affected", "version": "520.2 TCU4 HFR2", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n<br>"}], "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-36", "description": "CWE-36", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell", "dateUpdated": "2024-07-09T19:56:46.965Z"}, "references": [{"url": "https://process.honeywell.com"}, {"url": "https://www.honeywell.com/us/en/product-security"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:59:44.316Z"}, "title": "CVE Program Container", "references": [{"url": "https://process.honeywell.com", "tags": ["x_transferred"]}, {"url": "https://www.honeywell.com/us/en/product-security", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "B528F553-0D96-4A1D-9ABE-DA9555534BB2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "E30EFCB6-6534-46EE-A743-2218FD0DAA81", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "67C0BF18-A928-4A47-A71E-2216BE4ECB90", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*", "matchCriteriaId": "F436C92C-7EED-44A5-B53D-12B54652D0A1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning."}, {"lang": "es", "value": "Un atacante podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la lectura de archivos desde Honeywell Experion ControlEdge VirtualUOC y ControlEdge UOC. Esta explotaci\u00f3n podr\u00eda usarse para leer archivos del controlador que pueden exponer informaci\u00f3n limitada del dispositivo. Honeywell recomienda actualizar a la versi\u00f3n m\u00e1s reciente del producto. Consulte la Notificaci\u00f3n de seguridad de Honeywell para obtener recomendaciones sobre actualizaci\u00f3n y control de versiones."}], "id": "CVE-2023-5390", "lastModified": "2024-07-09T20:15:08.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@honeywell.com", "type": "Secondary"}]}, "published": "2024-01-31T18:15:46.780", "references": [{"source": "psirt@honeywell.com", "tags": ["Product"], "url": "https://process.honeywell.com"}, {"source": "psirt@honeywell.com", "tags": ["Not Applicable"], "url": "https://www.honeywell.com/us/en/product-security"}], "sourceIdentifier": "psirt@honeywell.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-36"}], "source": "psirt@honeywell.com", "type": "Secondary"}]}