Vulnerability details
CVE-2023-5878
Honeywell OneWireless Network Wireless Device Manager
OneWireless command injection possible when updating firmware
CVSS 4.0
9.4Critical
Official description
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to R322.3, R330.2 or the most recent version of this product2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.4Critical | 4.0 | CVEProject cvelistV5 (CNA) (Honeywell) | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Honeywell | OneWireless Network Wireless Device Manager | 310.1 ≤ v ≤ 322.2 | CVEProject cvelistV5 (CNA) |
| Honeywell | OneWireless Network Wireless Device Manager | 323.1 ≤ v ≤ 330.1 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-02-06
- Last updated
- 2025-02-18
- State
- Published
- Assigner (CNA)
- Honeywell
Exploit prediction (EPSS)
0.96%
Probability of exploitation in 30 days
62%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')