Debug Messages Revealing Unnecessary Information in Honeywell International, Inc products - CVE-2023-5392

Vulnerability identifier: #VU89017

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-5392

CWE-ID: CWE-1295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the debug messages revealing unnecessary information. A remote attacker can extract more information from memory over the network than is required.

Safety Manager
Safety Manager SC
Experion PKS
Experion PlantCruise
Experion LX

Install updates from vendor's website.

Experion PKS - addressed in versions R510.2 HF14, R511.5 TCU4 HF4, R520.1 TCU5, R520.2 TCU4 HF2
Experion LX - addressed in versions R511.5 TCU4 HF4, R520.1 TCU5, R520.2 TCU4 HF2
Experion PlantCruise - addressed in versions R511.5 TCU4 HF4, R520.1 TCU5, R520.2 TCU4 HF2

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-116-04

• Multiple vulnerabilities in Honeywell Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager and Safety Manager SC