Input validation error in Honeywell International, Inc products - CVE-2023-5397

Vulnerability identifier: #VU89026

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-5397

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.

Safety Manager
Safety Manager SC
Experion PKS
Experion PlantCruise
Experion LX

Install updates from vendor's website.

Experion PKS - addressed in versions R510.2 HF14, R511.5 TCU4 HF4, R520.1 TCU5, R520.2 TCU4 HF2
Experion LX - addressed in versions R511.5 TCU4 HF4, R520.1 TCU5, R520.2 TCU4 HF2
Experion PlantCruise - addressed in versions R511.5 TCU4 HF4, R520.1 TCU5, R520.2 TCU4 HF2

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-116-04

• Multiple vulnerabilities in Honeywell Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager and Safety Manager SC