Skip to content
OpenAdvisories
Critical ICSA-23-194-06 9 CVEs

Honeywell Experion PKS, LX and PlantCruise

Published Jul 13, 2023 · Updated Jul 13, 2023

Vendor: Honeywell Product: Experion LX Product: Experion PKS Product: Experion PlantCruise

Summary

Successful exploitation of these vulnerabilities could cause a denial-of-service condition, allow privilege escalation or allow remote code execution.

Vulnerabilities 9

  • Critical 9.8
    CVE-2023-23585

    Server DoS due to heap overflow

    Experion server DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation.  See Honeywell Security Notification for recommendations on upgrading and versioning.

    Honeywell Experion Server Experion Station Direct Station ICS / OT
  • Critical 9.8
    CVE-2023-24480

    Controller stack overflow when decoding messages from the server

    Controller DoS due to stack overflow when decoding a message from the server.  See Honeywell Security Notification for recommendations on upgrading and versioning.

    Honeywell C300 ICS / OT
  • Critical 9.8
    CVE-2023-25078

    DoS due to heap overflow

    Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation.  See Honeywell Security Notification for recommendations on upgrading and versioning.

    Honeywell Experion Server Engineering Station Experion Station ICS / OT
  • Critical 9.8
    CVE-2023-25178

    Controller design flaw - unsigned firmware

    Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.

    Honeywell C300 ICS / OT
  • Critical 9.8
    CVE-2023-25770

    Controller stack overflow on decoding messages from the server

    Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.

    Honeywell C300 ICS / OT
  • High 7.5
    CVE-2023-22435

    Server bad parsing implementation - stack overflow in server::get_db_path_for_driver

    Experion server may experience a DoS due to a stack overflow when handling a specially crafted message.

    Honeywell Experion Server Engineering Station Experion Station ICS / OT
  • High 7.5
    CVE-2023-24474

    Server deserialization missing boundary checks - heap overflow in communication between server and controller

    Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message

    Honeywell Experion Server Experion Station Direct Station ICS / OT
  • High 7.5
    CVE-2023-25948

    Server Data type confusion - info leak

    Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.

    Honeywell Experion Server Direct Station Engineering Station ICS / OT
  • High 7.5
    CVE-2023-26597

    Controller DOS on sending error response

    Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on up…

    Honeywell C300 ICS / OT

Revision history

  1. #1

    Initial Publication

References