CVE-2023-5390 Path traversal in ControlEdge UOC
An attacker can read arbitrary files from Honeywell ControlEdge UOC devices, potentially exposing limited device information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5390?
CVE-2023-5390 is a medium-severity path traversal vulnerability in Honeywell ControlEdge UOC, published on 31 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
Which versions are affected by CVE-2023-5390?
It affects 2 products.
Products include Honeywell Controledge Unit Operations Controller Firmware, Honeywell Controledge Virtual Unit Operations Controller Firmware.
How do I fix CVE-2023-5390?
No fix has been published for CVE-2023-5390 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-5390 being exploited?
There is no known exploitation of CVE-2023-5390 in the wild and no public exploit code.
Other vulnerabilities in Honeywell ControlEdge UOC
Sources
Also known as GHSA-qj3p-g2m7-rx94.