CISA Alerts: April 25, 2024 – Honeywell Products

CISA Alert: Honeywell products

CISA Alert Highlights for April 25, 2024 – Honeywell Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager, Safety Manager SC

How are Vulnerabilities Rated?

These latest cybersecurity vulnerabilities focus on Honeywell Experion PKS, Experion LX, PlantCruise, and Safety Manager products that have been recently released by CISA in conjunction with the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD). These product vulnerabilities, targeting Chemical, Critical Manufacturing, Energy, Water and Wastewater Systems have all been rated as medium to high-risk per the criteria listed below.

These vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High: vulnerabilities with a CVSS base score of 7.0–10.0
  • Medium: vulnerabilities with a CVSS base score of 4.0–6.9
  • Low: vulnerabilities with a CVSS base score of 0.0–3.9

Successful exploitation of these vulnerabilities could disclose sensitive information, allow privilege escalation, or allow remote code execution.

Vendor/Product:  Honeywell reports these vulnerabilities that affect the following versions of Experion PKS, LX, PlantCruise, Safety Manager, and Safety Manager SC:
  • Experion PKS: All releases prior to R510.2 HF14
  • Experion PKS: All releases prior to R511.5 TCU4 HF4
  • Experion PKS: All releases prior to R520.1 TCU5
  • Experion PKS: All releases prior to R520.2 TCU4 HF2
  • Experion LX: All releases prior to R511.5 TCU4 HF4
  • Experion LX: All releases prior to R520.1 TCU5
  • Experion LX: All releases prior to R520.2 TCU4 HF2
  • PlantCruise by Experion: All releases prior to R511.5 TCU4 HF4
  • PlantCruise by Experion: All releases prior to R520.1 TCU5
  • PlantCruise by Experion: All releases prior to R520.2 TCU4 HF2
  • Safety Manager: R15x, R16x up to and including R162.10
  • Safety Manager SC: R210.X, R211.1, R211.2, R212.1

Description: 

Exposed Dangerous Method or Function

Absolute Path Traversal

Stack-based Buffer Overflow

Debug Messages Revealing Unnecessary Information

Out-of-bounds Write, Heap-based Buffer Overflow

Binding to an Unrestricted IP Address

Improper Input Validation

Buffer Access with Incorrect Length Value

Improper Restriction of Operations within the Bounds of a Memory Buffer

Improper Handling of Length Parameter Inconsistency

Mitigation:  Honeywell fixed the reported issues and advises users to upgrade to version referenced in the Security Notice or CVE record.

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

  • Ensure the least-privilege user principle is followed.
  • Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolate them from business networks.
  • When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

If you suspect you may have a vulnerability that you need help to mitigate, the cybersecurity team Spry Squared is standing by.

Posted in CISA Alerts Cybersecurity Cybersecurity Advisories Firmware Government IT Managed Services Managed IT Managed Service Provider Managed Services News Technology Vulnerability ManagementTags