CVE-2014-5435 Memory corruption in Experion PKS
Arbitrary memory write in Honeywell Experion PKS allows remote code execution or denial of service, requiring an upgrade to supported versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-5435?
CVE-2014-5435 is a critical memory corruption vulnerability in Honeywell Experion PKS, published on 8 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Which versions are affected by CVE-2014-5435?
It affects 1 product.
Products include Honeywell Experion Process Knowledge System.
How do I fix CVE-2014-5435?
No fix has been published for CVE-2014-5435 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2014-5435 being exploited?
There is no known exploitation of CVE-2014-5435 in the wild and no public exploit code.
Other vulnerabilities in Honeywell Experion PKS
Sources
Also known as GHSA-3gh5-wq3g-32vj.