CVE-2014-2717

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.

CVSS v2.0 7.6 HIGH

7.6^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:honeywell:falcon_xlweb_linux_controller::::::::
	cpe:2.3:h:honeywell:falcon_xlweb_xlwebexe::::::::

History

No history.

Information

Published : 2014-07-24 14:55

Updated : 2024-02-04 18:35

NVD link : CVE-2014-2717

Mitre link : CVE-2014-2717

CVE.ORG link : CVE-2014-2717

JSON object : View

Products Affected

honeywell

falcon_xlweb_linux_controller
falcon_xlweb_xlwebexe

CWE

NVD-CWE-Other

{"id": "CVE-2014-2717", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-07-24T14:55:07.363", "references": [{"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page."}, {"lang": "es", "value": "Los dispositivos controladores Honeywell FALCON XLWeb Linux 2.04.01 y anteriores y los dispositivos controladores FALCON XLWeb XLWebExe 2.02.11 y anetriores permiten a atacantes remotos evadir la autenticaci\u00f3n y obtener el acceso administrativo mediante la visita a la p\u00e1gina del cambio de contrase\u00f1a."}], "lastModified": "2014-07-25T13:52:32.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:falcon_xlweb_linux_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCD8DDD2-BB5C-4EB4-9475-67F5B6341DBD", "versionEndIncluding": "2.04.01"}, {"criteria": "cpe:2.3:h:honeywell:falcon_xlweb_xlwebexe:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33EAB24D-D7D1-46B5-9740-3A33425AE027", "versionEndIncluding": "2.02.11"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/552.html\" target=\"_blank\">CWE-552: CWE-552: Files or Directories Accessible to External Parties</a>", "sourceIdentifier": "cve@mitre.org"}