CVE-2014-9187 Memory corruption in Experion PKS
Heap-based buffer overflows in Honeywell Experion PKS allow remote attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-9187?
CVE-2014-9187 is a critical memory corruption vulnerability in Honeywell Experion PKS, published on 25 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Which versions are affected by CVE-2014-9187?
It affects 1 product.
Products include Honeywell Experion Process Knowledge System.
How do I fix CVE-2014-9187?
No fix has been published for CVE-2014-9187 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2014-9187 being exploited?
There is no known exploitation of CVE-2014-9187 in the wild and no public exploit code.
Other vulnerabilities in Honeywell Experion PKS
Sources
Also known as GHSA-m8p6-m7c7-56jf.