3.7low
CVE-2016-8344
An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, R…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
3.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 75%
Public exploits
0
none known
Summary
An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410, Experion PKS, Release 430, and Experion PKS, Release 431. Experion PKS does not properly validate input. By sending a specially crafted packet, an attacker could cause the process to terminate. A successful exploit would prevent firmware uploads to the Series-C devices.
Exploit prediction (EPSS)
1.55% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 3.7 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Affected products
- n/a Honeywell Experion PKS through 431
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- ics-cert.us-cert.gov /advisories/ICSA-16-301-01 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/93950 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-8344
- NVD: CVE-2016-8344
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.