CVE-2023-3710CWE-20

Printer web page invalid command execution

Critical · published September 12, 2023

CVSS v3.1
9.9
EPSS
49%
Percentile
98.9
In the wild
Unconfirmed
What it is

🔥 A single misstep in input validation could let attackers run commands on your Honeywell PM43 printers! Think of it like an open door in a highly secure data center, where someone can just waltz in and start tampering with systems without a keycard. This vulnerability allows intruders to issue commands, just like an unauthorized guest swapping out server configurations at will! An attacker could exploit this flaw to execute any command on the printer, potentially leading to unauthorized data access or disruption of services. The consequences could be absolutely devastating, leaving your network vulnerable and your operations in disarray!

Put simply

Think of it like an open door in a highly secure data center, where someone can just waltz in and start tampering with systems without a keycard. This vulnerability allows intruders to issue commands, just like an unauthorized guest swapping out server configurations at will! This improper input validation vulnerability in Honeywell PM43 printers on ARM architecture allows command injection through the printer's web interface. Versions prior to P10.19.050004 are affected, making it an urgent security concern.

What to do

An attacker could exploit this flaw to execute any command on the printer, potentially leading to unauthorized data access or disruption of services. The consequences could be absolutely devastating, leaving your network vulnerable and your operations in disarray! Update all Honeywell PM43 printers to firmware version MR19.5 (e.g., P10.19.050006) as soon as possible. Regularly review your firmware to ensure you’re not using outdated versions, and consider implementing additional network security measures to protect against unauthorized access. You've got this! By staying proactive, you'll have your printers locked down in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.49040 · 98.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-09-12T19:55Z
EPSS history
Timeline
  • 15 SEP 03:13Z
    EPSS moved 33% → 49%
    epss
  • 14 SEP 03:15Z
    EPSS moved 33% → 49%
    epss
  • 12 SEP 19:55Z
    Printer web page invalid command execution
    cvelistv5