description: An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
problem types: CWE-36
affected:
{
defaultStatus: unaffected
platforms: Experion PKS
product: ControlEdge UOC
vendor: Honeywell
versions:
changes: [at: 520.2 TCU4 HF1, status: unaffected], lessThanOrEqual: 520.2 TCU4, status: unaffected, version: 520.2, versionType: semver
changes: [at: 510.2 HF14, status: unaffected], lessThanOrEqual: 510.2 HF13, status: unaffected, version: 510.1, versionType: semver
changes: [at: 520.1 TCU5, status: unaffected], lessThanOrEqual: 520.1 TCU4, status: unaffected, version: 520.1, versionType: semver
changes: [at: 511.5 TCU4 HF4, status: unaffected], lessThanOrEqual: 511.5 TCU4 HF3, status: unaffected, version: 511.1, versionType: semver
}
{
defaultStatus: unaffected
platforms: Experion LX
product: ControlEdge UOC
vendor: Honeywell
versions:
changes: [at: 520.2 TCU4 HF2, status: unaffected], lessThanOrEqual: 520.2 TCU4, status: unaffected, version: 520.2, versionType: semver
changes: [at: 511.5 TCU4 HF4, status: unaffected], lessThanOrEqual: 511.5 TCU4 HF3, status: unaffected, version: 511.1, versionType: semver
changes: [at: 520.1 TCU5, status: unaffected], lessThanOrEqual: 520.1 TCU4, status: unaffected, version: 520.1, versionType: semver
}
{
defaultStatus: unaffected
platforms: PlantCruise by Experion
product: ControlEdge UOC
vendor: Honeywell
versions:
changes: [at: 520.2 TCU4 HF2, status: unaffected], lessThanOrEqual: 520.2 TCU4, status: unaffected, version: 520.2, versionType: semver
changes: [at: 520.1 TCU5, status: unaffected], lessThanOrEqual: 520.1 TCU4, status: unaffected, version: 520.1, versionType: semver
changes: [at: 511.5 TCU4 HF4, status: unaffected], lessThanOrEqual: 511.5 TCU4 HF3, status: unaffected, version: 520.2 TCU4 HFR2, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL