Vulnerability · Published Feb 6, 2025 · Assigned by Honeywell
CVE-2023-5878OneWireless command injection possible when updating firmware
Critical 9.4
In plain English
A critical-severity command injection in OneWireless Network Wireless Device Manager from Honeywell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to R322.3, R330.2 or the most recent version of this product2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | OneWireless Network Wireless Device Manager | 310.1 – through 322.2323.1 – through 330.1 |
Weakness: CWE-77 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H