CVE-2016-8344 Denial of service in Honeywell Experion PKS through 431

What is CVE-2016-8344?

CVE-2016-8344 is a low-severity denial of service vulnerability in Honeywell Experion PKS through 431, published on 13 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410, Experion PKS, Release 430, and Experion PKS, Release 431. Experion PKS does not properly validate input. By sending a specially crafted packet, an attacker could cause the process to terminate. A successful exploit would prevent firmware uploads to the Series-C devices.

Weakness: CWE-20

Which versions are affected by CVE-2016-8344?

It affects 1 product.

Products include Honeywell Experion Process Knowledge System.

How do I fix CVE-2016-8344?

No fix has been published for CVE-2016-8344 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2016-8344 being exploited?

There is no known exploitation of CVE-2016-8344 in the wild and no public exploit code.

Other vulnerabilities in Honeywell Experion PKS through 431

• CVE-2014-5435 Memory corruption in Experion PKS Critical 9.8
• CVE-2014-9186 File upload in Experion PKS Critical 9.8
• CVE-2014-9187 Memory corruption in Experion PKS Critical 9.8
• CVE-2014-9189 Memory corruption in Experion PKS Critical 9.8
• CVE-2014-5436 Path traversal in Experion PKS High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c85h-7cv2-rr9p.