CVE-2014-5435

Published: Apr 8, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.

Affected (3)

Products: Honeywell: Experion Process Knowledge System

Honeywell

1 product

Experion Process Knowledge System

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Honeywell Experion Process Knowledge System	From r400 to r400.6
Honeywell Experion Process Knowledge System	From r410 to r410.6
Honeywell Experion Process Knowledge System	From r430 to r430.2

Related CWEs

CWE-123

Write-what-where Condition

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://ics-cert.us-cert.gov/advisories/ICSA-14-352-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

https://ics-cert.us-cert.gov/advisories/ICSA-14-352-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.