CVE-2014-9187
published 2019-03-25CVE-2014-9187: Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all…
PriorityP358critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.62%
88.1th percentile
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| honeywell | experion_pks | — | — |
| honeywell | experion_pks | — | — |
| honeywell | experion_pks | — | — |
| honeywell | experion_process_knowledge_system | >= r400 < r400.6 | r400.6 |
| honeywell | experion_process_knowledge_system | >= r410 < r410.6 | r410.6 |
| honeywell | experion_process_knowledge_system | >= r430 < r430.2 | r430.2 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Honeywell Experion PKS Vulnerabilities
cisa_ics·2019-04-10
Honeywell Experion PKS Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Honeywell Experion PKS Vulnerabilities
Last RevisedApril 10, 2019
Alert CodeICSA-14-352-01
## OVERVIEW
Alexander Tlyapov, Gleb Gritsai, Kirill Nesterov, Artem Chaykin and Ilya Karpov of the Positive Technologies Research Team and Security Lab have identified vulnerabilities in Honeywell’s Experion Process Knowledge System (EPKS) application. Honeywell has produced several patch updates (R400.6, R410.6 and 430.6) that resolve these vulnerabilities.
These vulnerabilities could be exploited remotely.
## AFFECTED PRODUCTS
The following Honeywell Experion PKS versions are affected
GHSA
GHSA-m8p6-m7c7-56jf: Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400
ghsa_unreviewed·2022-05-13
CVE-2014-9187 [CRITICAL] CWE-119 GHSA-m8p6-m7c7-56jf: Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
No detection rules found.
No public exploits indexed.
2019-03-25
Published