CVE-2014-5435
published 2019-04-08CVE-2014-5435: An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before…
PriorityP358critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.46%
87.6th percentile
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| honeywell | experion_pks | — | — |
| honeywell | experion_pks | — | — |
| honeywell | experion_pks | — | — |
| honeywell | experion_process_knowledge_system | >= r400 < r400.6 | r400.6 |
| honeywell | experion_process_knowledge_system | >= r410 < r410.6 | r410.6 |
| honeywell | experion_process_knowledge_system | >= r430 < r430.2 | r430.2 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Honeywell Experion PKS Vulnerabilities
cisa_ics·2019-04-10
Honeywell Experion PKS Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Honeywell Experion PKS Vulnerabilities
Last RevisedApril 10, 2019
Alert CodeICSA-14-352-01
## OVERVIEW
Alexander Tlyapov, Gleb Gritsai, Kirill Nesterov, Artem Chaykin and Ilya Karpov of the Positive Technologies Research Team and Security Lab have identified vulnerabilities in Honeywell’s Experion Process Knowledge System (EPKS) application. Honeywell has produced several patch updates (R400.6, R410.6 and 430.6) that resolve these vulnerabilities.
These vulnerabilities could be exploited remotely.
## AFFECTED PRODUCTS
The following Honeywell Experion PKS versions are affected
GHSA
GHSA-3gh5-wq3g-32vj: An arbitrary memory write vulnerability exists in the dual_onsrv
ghsa_unreviewed·2022-05-13
CVE-2014-5435 [CRITICAL] CWE-787 GHSA-3gh5-wq3g-32vj: An arbitrary memory write vulnerability exists in the dual_onsrv
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-04-08
Published