CVE-2017-5141: Medium severity Honeywell XL Web II controller vulnerability
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated sessions (SESSION FIXATION).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Honeywell XL Web II controllerto a version that resolves this vulnerability.Fixed in XL1000C500 XLWebExe-2-01-00 - Upgrade
Upgrade
Honeywell XL Webto a version that resolves this vulnerability.Fixed in XLWeb 500 XLWebExe-1-02-08
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5141?
CVE-2017-5141 is considered a high severity vulnerability due to its potential to allow unauthorized session hijacking.
How do I fix CVE-2017-5141?
To fix CVE-2017-5141, you should upgrade the Honeywell XL Web II controller to a version above xlwebexe-2-01-00 or xlwebexe-1-02-08.
What systems are affected by CVE-2017-5141?
CVE-2017-5141 affects the Honeywell XL Web II controller versions xlwebexe-1-02-08 and xlwebexe-2-01-00.
What are the implications of CVE-2017-5141 for users?
The implications of CVE-2017-5141 can lead to session theft, allowing attackers to impersonate legitimate users.
Is there a workaround for CVE-2017-5141?
Currently, there are no official workarounds for CVE-2017-5141 other than upgrading to a secure version.