CVE:CVE-2015-0984
CNNVD:CNNVD-201503-636
FTP server on Honeywell Excel Web XL1000C50等是美国霍尼韦尔国际（Honeywell International）公司的一款用于XLWeb控制器系列（基于Web的SCADA系统）的FTP服务器。
多款Honeywell Excel Web控制器的FTP服务器中存在目录遍历漏洞。远程攻击者可借助特制的路径名利用该漏洞读取Web root目录下的任意文件，获取管理员登陆访问权限。以下产品及版本受到影响：Honeywell Excel Web XL1000C50 52 I/O，XL1000C100 104 I/O，XL1000C500 300 I/O，XL1000C1000 600 I/O，XL1000C50U 52 I/O UUKL，XL1000C100U 104 I/O UUKL，XL1000C500U 300 I/O UUKL，XL1000C1000U 600 I/O UUKL控制器2.04.01之前版本。
solution:Upgrade honeywell excel_web_xl_1000c100_104_i/o to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c1000_600_i/o to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c1000_600_i/o_uukl to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c100u_104_i/o_uukl to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c50_52_i/o to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c500_300_i/o to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c500_300_i/o_uukl to a higher version than 2.04.00,and avoid the version (,2.04.00]; Upgrade honeywell excel_web_xl_1000c50u_52_i/o_uukl to a higher version than 2.04.00,and avoid the version (,2.04.00]