CVE-2014-2717
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.
- CVSS 2.0
- 7.6 HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
- EPSS
- 3.74% probability · 89th percentile
- CISA KEV
- Not listed
- Affected
- honeywell/falcon xlweb linux controller · honeywell/falcon xlweb xlwebexe
- Source
- cve@mitre.org
References
- http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01Third Party Advisory, US Government Resource
- http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.