CVE-2023-25178: Controller design flaw - unsigned firmware
Published Jul 13, 2023
·Updated
Controller may be loaded with malicious firmware which could enable remote code execution
Affected Software
12 affected components
Honeywell C300 Firmware>=501.1<=501.6hf8
Honeywell C300 Firmware>=510.1<=510.2hf12
Honeywell C300 Firmware>=511.1<=511.5tcu3
Honeywell C300 Firmware>=520.1<=520.1tcu4
Honeywell C300 Firmware>=520.2<=520.2tcu2
Honeywell C300
All of the following
Any of the following
Honeywell C300 Firmware>=501.1<=501.6hf8
Honeywell C300 Firmware>=510.1<=510.2hf12
Honeywell C300 Firmware>=511.1<=511.5tcu3
Honeywell C300 Firmware>=520.1<=520.1tcu4
Honeywell C300 Firmware>=520.2<=520.2tcu2
Honeywell C300
Event History
Jul 13, 2023
CVE Published
via MITRE·10:59 AM
Data Sourced
via MITRE·10:59 AM
DescriptionSeverityWeakness
Data Sourced
11:15 AM
Description
Frequently Asked Questions
1
What is CVE-2023-25178?
CVE-2023-25178 is a vulnerability that allows an attacker to load malicious firmware on a controller, potentially enabling remote code execution.
2
How severe is CVE-2023-25178?
CVE-2023-25178 has a severity rating of 9.8, which is considered critical.
3
Which software versions are affected by CVE-2023-25178?
CVE-2023-25178 affects the Honeywell C300 Firmware versions 501.1 to 501.6hf8, 510.1 to 510.2hf12, 511.1 to 511.5tcu3, 520.1 to 520.1tcu4, and 520.2 to 520.2tcu2.
4
How can I fix CVE-2023-25178?
To fix CVE-2023-25178, it is recommended to update to a secure version of the Honeywell C300 Firmware provided by Honeywell.
5
Where can I find more information about CVE-2023-25178?
You can find more information about CVE-2023-25178 at the official Honeywell Process website: https://process.honeywell.com