title: Potential user privilege escalation
description: Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004.
Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
problem types: CWE-552 Files or Directories Accessible to External Parties
affected:
{
defaultStatus: unaffected
modules: Printer web page
platforms: 32 bit
product: PM23/43
vendor: Honeywell
versions:
lessThan: P10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PC23/43, PD43
vendor: Honeywell
versions:
lessThan: K10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PM42
vendor: Honeywell
versions:
lessThan: T10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PM42
vendor: Honeywell
versions:
lessThan: L10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PX4ie/6ie
vendor: Honeywell
versions:
lessThan: A10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PX45/65
vendor: Honeywell
versions:
lessThan: B10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PD45, PX240
vendor: Honeywell
versions:
lessThan: F10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PX940
vendor: Honeywell
versions:
lessThan: H10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PM45
vendor: Honeywell
versions:
lessThan: J10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: RP2f/RP4f
vendor: Honeywell
versions:
lessThan: M10.19.050006, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL