title: Potential Predictable Session ID
description: Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
problem types: CWE-384 Session Fixation
affected:
{
defaultStatus: unaffected
modules: Printer web page
platforms: 32 bit
product: PM23/43
vendor: Honeywell
versions:
lessThan: P10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PC23/43, PD43
vendor: Honeywell
versions:
lessThan: K10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PM42
vendor: Honeywell
versions:
lessThan: T10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PM42
vendor: Honeywell
versions:
lessThan: L10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PX4ie/6ie
vendor: Honeywell
versions:
lessThan: A10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PX45/65
vendor: Honeywell
versions:
lessThan: B10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PD45, PX240
vendor: Honeywell
versions:
lessThan: F10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PX940
vendor: Honeywell
versions:
lessThan: H10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: PM45
vendor: Honeywell
versions:
lessThan: J10.19.050004, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
platforms: 32 bit
product: RP2f/RP4f
vendor: Honeywell
versions:
lessThan: M10.19.050006, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL