CVE-2023-24474 Server deserialization missing boundary checks - heap overflow in communication between server and controller
A heap overflow in Experion server communication allows attackers to cause a denial of service via crafted messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-24474?
CVE-2023-24474 is a high-severity memory corruption vulnerability in Honeywell Direct Station, published on 13 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Experion server may experience a DoS due to a heap overflow which could occur when handling a specially crafted message
Which versions are affected by CVE-2023-24474?
It affects 4 products.
Products include Honeywell Direct Station, Honeywell Engineering Station, Honeywell Experion Server, Honeywell Experion Station.
How do I fix CVE-2023-24474?
No fix has been published for CVE-2023-24474 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-24474 being exploited?
There is no known exploitation of CVE-2023-24474 in the wild and no public exploit code.
Other vulnerabilities in Honeywell Direct Station
Sources
Also known as GHSA-rm26-gpm4-m74x.