Vulnerability CVE-2014-2717
Published: 2014-07-24

Description:
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.

See advisories in our WLB2 database:
Topic
Author
Date
High
Honeywell Falcon Administrative Bypass
Martin Jartelius
02.10.2014
Med.
Honeywell XLWEB SCADA Path Traversal
Martin Jartelius
24.04.2015

Type:

CWE-Other

CVSS2 => (AV:N/AC:H/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.6/10
10/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Honeywell -> Falcon xlweb linux controller 
Honeywell -> Falcon xlweb xlwebexe 

 References:
http://ics-cert.us-cert.gov/advisories/ICSA-14-175-01
Copyright 2024, cxsecurity.com

 

Back to Top