description:
An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
problem types: CWE-749
affected:
{
defaultStatus: unaffected
platforms: Experion PKS
product: ControlEdge UOC
vendor: Honeywell
versions:
changes: [at: 520.2 TCU4 HF1, status: unaffected], lessThanOrEqual: 520.2 TCU4, status: unaffected, version: 520.2, versionType: semver
changes: [at: 510.2 HF14, status: unaffected], lessThanOrEqual: 510.2 HF13, status: unaffected, version: 510.1, versionType: semver
changes: [at: 520.1 TCU5, status: unaffected], lessThanOrEqual: 520.1 TCU4, status: unaffected, version: 520.1, versionType: semver
changes: [at: 511.5 TCU4 HF4, status: unaffected], lessThanOrEqual: 511.5 TCU4 HF3, status: unaffected, version: 511.1, versionType: semver
}
{
defaultStatus: unaffected
platforms: Experion LX
product: ControlEdge UOC
vendor: Honeywell
versions:
changes: [at: 520.2 TCU4 HF2, status: unaffected], lessThanOrEqual: 520.2 TCU4, status: unaffected, version: 520.2, versionType: semver
changes: [at: 511.5 TCU4 HF4, status: unaffected], lessThanOrEqual: 511.5 TCU4 HF3, status: unaffected, version: 511.1, versionType: semver
changes: [at: 520.1 TCU5, status: unaffected], lessThanOrEqual: 520.1 TCU4, status: unaffected, version: 520.1, versionType: semver
}
{
defaultStatus: unaffected
platforms: PlantCruise by Experion
product: ControlEdge UOC
vendor: Honeywell
versions:
changes: [at: 520.2 TCU4 HF2, status: unaffected], lessThanOrEqual: 520.2 TCU4, status: unaffected, version: 520.2, versionType: semver
changes: [at: 520.1 TCU5, status: unaffected], lessThanOrEqual: 520.1 TCU4, status: unaffected, version: 520.1, versionType: semver
changes: [at: 511.5 TCU4 HF4, status: unaffected], lessThanOrEqual: 511.5 TCU4 HF3, status: unaffected, version: 520.2 TCU4 HFR2, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL