CVE-2023-25770: Controller stack overflow on decoding messages from the server
Published Jul 13, 2023
·Updated
Controller DoS may occur due to buffer overflow when an error is generated in response to a specially crafted message.
Affected Software
12 affected components
Honeywell C300 Firmware>=501.1<=501.6hf8
Honeywell C300 Firmware>=510.1<=510.2hf12
Honeywell C300 Firmware>=511.1<=511.5tcu3
Honeywell C300 Firmware>=520.1<=520.1tcu4
Honeywell C300 Firmware>=520.2<=520.2tcu2
Honeywell C300
All of the following
Any of the following
Honeywell C300 Firmware>=501.1<=501.6hf8
Honeywell C300 Firmware>=510.1<=510.2hf12
Honeywell C300 Firmware>=511.1<=511.5tcu3
Honeywell C300 Firmware>=520.1<=520.1tcu4
Honeywell C300 Firmware>=520.2<=520.2tcu2
Honeywell C300
Event History
Jul 13, 2023
CVE Published
via MITRE·10:59 AM
Data Sourced
via MITRE·10:59 AM
DescriptionSeverityWeakness
Data Sourced
11:15 AM
Description
Frequently Asked Questions
1
What is CVE-2023-25770?
CVE-2023-25770 is a vulnerability that can cause a Denial of Service (DoS) attack on a controller due to a buffer overflow when an error is generated in response to a specially crafted message.
2
Which software is affected by CVE-2023-25770?
Honeywell C300 Firmware versions 501.1 to 501.6hf8, 510.1 to 510.2hf12, 511.1 to 511.5tcu3, 520.1, and 520.2tcu2 are affected by CVE-2023-25770.
3
What is the severity of CVE-2023-25770?
CVE-2023-25770 has a severity rating of 7.5 (Critical).
4
How can I fix CVE-2023-25770?
To fix CVE-2023-25770, it is recommended to update the Honeywell C300 Firmware to a non-vulnerable version.
5
Where can I find more information about CVE-2023-25770?
You can find more information about CVE-2023-25770 on the official Honeywell website (https://process.honeywell.com).