Description
Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to an attacker performing remote code execution or causing a failure.
See Honeywell Security Notification for recommendations on upgrading and versioning.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Honeywell | Experion Server | 520.2 – ≤ 520.2 TCU4, 510.1 – ≤ 510.2 HF13, 520.1 – ≤ 520.1 TCU4, 511.1 – ≤ 511.5 TCU4 HF3, 520.2 – ≤ 520.2 TCU4, 511.1 – ≤ 511.5 TCU4 HF3, 520.1 – ≤ 520.1 TCU4, 520.2 – ≤ 520.2 TCU4, 520.1 – ≤ 520.1 TCU4, 520.2 TCU4 HFR2 – ≤ 511.5 TCU4 HF3 | — |
Advisories 1
- ICSA-24-116-04 Honeywell Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager, Safety Manager SC CISA ICS & IT advisories · Apr 25, 2024