CVE-2023-3710: Printer web page invalid command execution
First published: Tue Sep 12 2023(Updated: )
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
Credit: psirt@honeywell.com psirt@honeywell.com ByteHunter
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell Pm43 Firmware | <p10.19.050004 | |
| Honeywell PM43 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
- https://www.honeywell.com/us/en/product-security
- https://www.exploit-db.com/exploits/51885
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-3710.
What is the severity of CVE-2023-3710?
CVE-2023-3710 has a severity rating of critical.
What is the affected software for CVE-2023-3710?
The affected software for CVE-2023-3710 is Honeywell PM43.
How does the vulnerability in Honeywell PM43 manifest?
The vulnerability in Honeywell PM43 manifests as an Improper Input Validation vulnerability, allowing Command Injection.
How can I fix the vulnerability in Honeywell PM43?
To fix the vulnerability in Honeywell PM43, update to the latest available firmware version of the printer, specifically MR19.5 (e.g. P10.19.050006).
- collector/nvd-api
- collector/nvd-index
- agent/weakness
- agent/softwarecombine
- agent/type
- exploited/true
- collector/exploitdb-recent
- source/ExploitDB
- alias/CVE-2023-3710
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/honeywell
- canonical/honeywell pm43 firmware
- canonical/honeywell pm43