CVE-2023-25178CWE-345

Controller design flaw - unsigned firmware

Critical · published July 13, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

🚨 A crafty attacker can load malicious firmware into the controller, leading to full remote code execution! 🔥 Think of it like a sneaky delivery service that swaps your new fridge with a faulty one right at your doorstep — the moment you plug it in, the remote intruder takes control! If exploited, an attacker could take over the controller, wreaking havoc on your system—accessing sensitive data, altering settings, and even shutting down critical services. This could have catastrophic impacts on operations, making it a high-stakes situation.

Put simply

Think of it like a sneaky delivery service that swaps your new fridge with a faulty one right at your doorstep — the moment you plug it in, the remote intruder takes control! This vulnerability allows an attacker to upload harmful firmware to the controller, which may then execute malicious code without proper authorization, resulting in a severe breach of security.

What to do

If exploited, an attacker could take over the controller, wreaking havoc on your system—accessing sensitive data, altering settings, and even shutting down critical services. This could have catastrophic impacts on operations, making it a high-stakes situation. Immediately upgrade your firmware to the recommended version as per Honeywell Security Notification. Audit any existing controllers to ensure they're not running vulnerable versions. Implement monitoring to detect any unauthorized firmware changes in the future. You've got this! Take these steps, and you'll be back in control in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2023-07-13T10:59Z
EPSS history
Timeline
  • 13 JUL 10:59Z
    Controller design flaw - unsigned firmware
    cvelistv5