CVE-2023-5390

{"id": "CVE-2023-5390", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@honeywell.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-01-31T18:15:46.780", "references": [{"url": "https://process.honeywell.com", "tags": ["Product"], "source": "psirt@honeywell.com"}, {"url": "https://www.honeywell.com/us/en/product-security", "tags": ["Not Applicable"], "source": "psirt@honeywell.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "psirt@honeywell.com", "description": [{"lang": "en", "value": "CWE-36"}]}], "descriptions": [{"lang": "en", "value": "An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product.\u00a0See Honeywell Security Notification for recommendations on upgrading and versioning.\n\n\n"}, {"lang": "es", "value": "Un atacante podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la lectura de archivos desde Honeywell Experion ControlEdge VirtualUOC y ControlEdge UOC. Esta explotaci\u00f3n podr\u00eda usarse para leer archivos del controlador que pueden exponer informaci\u00f3n limitada del dispositivo. Honeywell recomienda actualizar a la versi\u00f3n m\u00e1s reciente del producto. Consulte la Notificaci\u00f3n de seguridad de Honeywell para obtener recomendaciones sobre actualizaci\u00f3n y control de versiones."}], "lastModified": "2024-02-08T17:18:46.787", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B528F553-0D96-4A1D-9ABE-DA9555534BB2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_unit_operations_controller:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E30EFCB6-6534-46EE-A743-2218FD0DAA81"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:controledge_virtual_unit_operations_controller_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67C0BF18-A928-4A47-A71E-2216BE4ECB90"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:controledge_virtual_unit_operations_controller:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F436C92C-7EED-44A5-B53D-12B54652D0A1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@honeywell.com"}