CVE-2017-5139
CriticalSummary
An issue exists in Honeywell XL Web II controllers, specifically XL1000C500 and XLWeb 500, related to the plaintext storage of passwords. Any user can disclose a password by accessing a specific URL.
Risk Assessment
The risk associated with this vulnerability is the potential exposure of passwords, which could lead to unauthorized access to the system. This poses a threat to data security and system integrity.
Recommendation
It is recommended to update the software to the latest version to eliminate the issue of plaintext password storage. Additionally, implementing password management security policies is advisable.
Other vulnerabilities in Honeywell XL Web II controller XL1000C500, XLWeb 500
See all- CVE-2017-5143High
An issue was discovered in Honeywell XL Web II, in the XL1000C500 and XLWeb 500 controllers, allowing a directory traversal attack. An unauthenticated user can access the system by visiting a specific URL.
- CVE-2017-5142Critical
An issue was discovered in Honeywell XL Web II controller XL1000C500 and XLWeb 500 related to improper privilege management. A user with low privileges can access a specific URL and change system parameters.
Original NVD description (English source)
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password.