CVE-2023-3711 Potential Predictable Session ID

Medium 6.4 Published 12 Sep 2023 Updated 12 Sep 2025

Attackers can predict session IDs to hijack user sessions on Honeywell PM43 printers, requiring a firmware upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-3711?

CVE-2023-3711 is a medium-severity authentication bypass vulnerability in Honeywell PC23/43, PD43, published on 12 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).

Weakness: CWE-384

Which versions are affected by CVE-2023-3711?

It affects 1 product.

Products include Honeywell Pm43 Firmware.

How do I fix CVE-2023-3711?

No fix has been published for CVE-2023-3711 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-3711 being exploited?

There is no known exploitation of CVE-2023-3711 in the wild and no public exploit code.

Sources

Also known as GHSA-4whc-qj2p-c6pg.