CVE-2023-25948

Server Data type confusion - info leak

State: Published
Severity: 7.5 High
Published: Jul 13, 2023
Updated: Mar 5, 2025
Reserved: Feb 28, 2023

Description

Server information leak of configuration data when an error is generated in response to a specially crafted message. See Honeywell Security Notification for recommendations on upgrading and versioning.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Honeywell

Weaknesses

CWE-394 Unexpected Status Code or Return Value

Affected Products

Product	Versions
Experion ServerHoneywell	501.1 through 501.6HF8Affected 510.1 through 510.2HF12Affected 511.1 through 511.5TCU3Affected 520.1 through 520.1TCU4Affected 520.2 through 520.2TCU2Affected
Experion StationHoneywell	501.1 through 501.6HF8Affected 510.1 through 510.2HF12Affected 511.1 through 511.5TCU3Affected 520.1 through 520.1TCU4Affected 520.2 through 520.2TCU2Affected
Engineering StationHoneywell	510.1 through 511.5TCU3Affected 520.1 through 520.1TCU4Affected 520.2 through 520.2TCU2Affected
Direct StationHoneywell	510.5 through 511.5TCU3Affected 520.1 through 520.1TCU4Affected 520.2 through 520.2TCU2Affected

References

https://process.honeywell.com/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.