CVE-2017-5143
HighSummary
An issue was discovered in Honeywell XL Web II, in the XL1000C500 and XLWeb 500 controllers, allowing a directory traversal attack. An unauthenticated user can access the system by visiting a specific URL.
Risk Assessment
An attacker may gain access to sensitive data or files within the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update the software to the latest version to mitigate the risk of attack and implement user authentication mechanisms.
Other vulnerabilities in Honeywell XL Web II controller XL1000C500, XLWeb 500
See all- CVE-2017-5142Critical
An issue was discovered in Honeywell XL Web II controller XL1000C500 and XLWeb 500 related to improper privilege management. A user with low privileges can access a specific URL and change system parameters.
- CVE-2017-5139Critical
An issue exists in Honeywell XL Web II controllers, specifically XL1000C500 and XLWeb 500, related to the plaintext storage of passwords. Any user can disclose a password by accessing a specific URL.
Original NVD description (English source)
An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL.