CVE-2023-5389: Honeywell ControlEdge UOC, заобикаляне на вход и права

Описание

Оригинално описание

An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC . This exploit could be used to write a file that may result in unexpected behavior based on configuration changes or updating of files that could result in subsequent execution of a malicious application if triggered. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning. 

Засегнати продукти

• Honeywell ControlEdge UOC: 520.2 до 520.2 TCU4; 510.1 до 510.2 HF13; 520.1 до 520.1 TCU4; 511.1 до 511.5 TCU4 HF3
• Honeywell ControlEdge UOC: 520.2 до 520.2 TCU4; 511.1 до 511.5 TCU4 HF3; 520.1 до 520.1 TCU4
• Honeywell ControlEdge UOC: 520.2 до 520.2 TCU4; 520.1 до 520.1 TCU4; 520.2 TCU4 HFR2 до 511.5 TCU4 HF3

Вид слабост

• CWE-749 Exposed Dangerous Method or Function

История

Други уязвимости в Honeywell ControlEdge UOC

• 5.3CVE-2023-5390

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-5389
• https://nvd.nist.gov/vuln/detail/CVE-2023-5389
• https://process.honeywell.com
• https://www.honeywell.com/us/en/product-security