Vulnerability · Published Jul 13, 2023 · Assigned by Honeywell

CVE-2023-26597Controller DOS on sending error response

High 7.5

In plain English

A high-severity uncontrolled resource consumption in C300 from Honeywell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning. See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected products (as reported)

Vendor	Product	Versions
Honeywell	C300	501.1 – through 501.6HF8510.1 – through 510.2HF12511.1 – through 511.5TCU3520.1 – through 520.1TCU4520.2 – through 520.2TCU2
Honeywell	C300	510.1 – through 511.5TCU3520.1 – through 520.1TCU4520.2 – through 520.2TCU2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://process.honeywell.com