CVE-2023-3711

Published: Sep 12, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).

Affected (1)

Products: Honeywell: Pm43 Firmware

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Honeywell Pm43 Firmware	Before p10.19.050004

Running on/with	Platform Versions
Honeywell Pm43	All versions

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (6)

https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004

Source: psirt@honeywell.com

Permissions Required

https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A

Source: psirt@honeywell.com

Permissions Required

https://www.honeywell.com/us/en/product-security

Source: psirt@honeywell.com

Product

https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

https://www.honeywell.com/us/en/product-security

Source: af854a3a-2127-422b-91ae-364da2661108

Product

Timeline

No history available yet.