CVE-2023-25178
Controller design flaw - unsigned firmware
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-02-28 CVE Reserved
- 2023-07-13 CVE Published
- 2025-03-05 CVE Updated
- 2025-05-31 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-345: Insufficient Verification of Data Authenticity
CAPEC
- CAPEC-638: Altered Component Firmware
References (1)
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Honeywell Search vendor "Honeywell" | C300 Firmware Search vendor "Honeywell" for product "C300 Firmware" | >= 501.1 <= 501.6hf8 Search vendor "Honeywell" for product "C300 Firmware" and version " >= 501.1 <= 501.6hf8" | - |
Affected
| in | Honeywell Search vendor "Honeywell" | C300 Search vendor "Honeywell" for product "C300" | - | - |
Safe
|
| Honeywell Search vendor "Honeywell" | C300 Firmware Search vendor "Honeywell" for product "C300 Firmware" | >= 510.1 <= 510.2hf12 Search vendor "Honeywell" for product "C300 Firmware" and version " >= 510.1 <= 510.2hf12" | - |
Affected
| in | Honeywell Search vendor "Honeywell" | C300 Search vendor "Honeywell" for product "C300" | - | - |
Safe
|
| Honeywell Search vendor "Honeywell" | C300 Firmware Search vendor "Honeywell" for product "C300 Firmware" | >= 511.1 <= 511.5tcu3 Search vendor "Honeywell" for product "C300 Firmware" and version " >= 511.1 <= 511.5tcu3" | - |
Affected
| in | Honeywell Search vendor "Honeywell" | C300 Search vendor "Honeywell" for product "C300" | - | - |
Safe
|
| Honeywell Search vendor "Honeywell" | C300 Firmware Search vendor "Honeywell" for product "C300 Firmware" | >= 520.1 <= 520.1tcu4 Search vendor "Honeywell" for product "C300 Firmware" and version " >= 520.1 <= 520.1tcu4" | - |
Affected
| in | Honeywell Search vendor "Honeywell" | C300 Search vendor "Honeywell" for product "C300" | - | - |
Safe
|
| Honeywell Search vendor "Honeywell" | C300 Firmware Search vendor "Honeywell" for product "C300 Firmware" | >= 520.2 <= 520.2tcu2 Search vendor "Honeywell" for product "C300 Firmware" and version " >= 520.2 <= 520.2tcu2" | - |
Affected
| in | Honeywell Search vendor "Honeywell" | C300 Search vendor "Honeywell" for product "C300" | - | - |
Safe
|