CVE-2014-9186
published 2019-04-08CVE-2014-9186: A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which…
PriorityP354critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.65%
88.2th percentile
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| honeywell | experion_pks | — | — |
| honeywell | experion_pks | — | — |
| honeywell | experion_pks | — | — |
| honeywell | experion_process_knowledge_system | >= r400 < r400.6 | r400.6 |
| honeywell | experion_process_knowledge_system | >= r410 < r410.6 | r410.6 |
| honeywell | experion_process_knowledge_system | >= r430 < r430.2 | r430.2 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Honeywell Experion PKS Vulnerabilities
cisa_ics·2019-04-10
Honeywell Experion PKS Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Honeywell Experion PKS Vulnerabilities
Last RevisedApril 10, 2019
Alert CodeICSA-14-352-01
## OVERVIEW
Alexander Tlyapov, Gleb Gritsai, Kirill Nesterov, Artem Chaykin and Ilya Karpov of the Positive Technologies Research Team and Security Lab have identified vulnerabilities in Honeywell’s Experion Process Knowledge System (EPKS) application. Honeywell has produced several patch updates (R400.6, R410.6 and 430.6) that resolve these vulnerabilities.
These vulnerabilities could be exploited remotely.
## AFFECTED PRODUCTS
The following Honeywell Experion PKS versions are affected
GHSA
GHSA-7q7j-2f25-p5hw: A file inclusion vulnerability exists in the confd
ghsa_unreviewed·2022-05-13
CVE-2014-9186 [CRITICAL] CWE-20 GHSA-7q7j-2f25-p5hw: A file inclusion vulnerability exists in the confd
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-04-08
Published