CVE-2014-5436 Path traversal in Experion PKS

What is CVE-2014-5436?

CVE-2014-5436 is a high-severity path traversal vulnerability in Honeywell Experion PKS, published on 8 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.

Weakness: CWE-22

Which versions are affected by CVE-2014-5436?

It affects 1 product.

Products include Honeywell Experion Process Knowledge System.

How do I fix CVE-2014-5436?

No fix has been published for CVE-2014-5436 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2014-5436 being exploited?

There is no known exploitation of CVE-2014-5436 in the wild and no public exploit code.

Other vulnerabilities in Honeywell Experion PKS

• CVE-2014-5435 Memory corruption in Experion PKS Critical 9.8
• CVE-2014-9186 File upload in Experion PKS Critical 9.8
• CVE-2014-9187 Memory corruption in Experion PKS Critical 9.8
• CVE-2014-9189 Memory corruption in Experion PKS Critical 9.8
• CVE-2016-8344 Denial of service in Honeywell Experion PKS through 431 Low 3.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-87hc-mm94-3rvr.