Lucene search

IcscertCVE-2014-9189

HistoryMar 25, 2019 - 8:29 p.m.

CVE-2014-9189

2019-03-2520:29:00

CWE-119

CWE-121

icscert

web.nvd.nist.gov

honeywell

experion pks

buffer overflow

vulnerability

cve-2014-9189

r400.6

r410.6

r430.2

remote code execution

memory corruption

denial of service

upgrade

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.006

Percentile

78.1%

JSON

Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.

Affected configurations

Nvd

Node

honeywellexperion_process_knowledge_systemRanger400–r400.6

honeywellexperion_process_knowledge_systemRanger410–r410.6

honeywellexperion_process_knowledge_systemRanger430–r430.2

VendorProductVersionCPE
honeywellexperion_process_knowledge_system*cpe:2.3:a:honeywell:experion_process_knowledge_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
honeywell	experion_process_knowledge_system	*	cpe:2.3:a:honeywell:experion_process_knowledge_system::::::::

CNA Affected

[
  {
    "product": "Experion PKS",
    "vendor": "Honeywell",
    "versions": [
      {
        "status": "affected",
        "version": "R40x prior to R400.6"
      },
      {
        "status": "affected",
        "version": "R41x prior to R410.6"
      },
      {
        "status": "affected",
        "version": "R43x prior to R430.2"
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSA-14-352-01

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.006

Percentile

78.1%

JSON

Related for CVE-2014-9189