Skip to content
OpenAdvisories
Critical · 9.4 CVE-2023-5878 EUVD-2023-58151GHSA-6xff-6366-vrm2

OneWireless command injection possible when updating firmware

Published Feb 6, 2025 · Updated Feb 18, 2025 · Assigned by Honeywell

Description

Honeywell OneWireless

Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to

R322.3, R330.2 or the most recent version of this product2.

Affected products

VendorProductAffectedFixed
Honeywell OneWireless Network Wireless Device Manager 310.1 – ≤ 322.2, 323.1 – ≤ 330.1 —

References