Honeywell c300 vulnerabilities

2 CVEs affecting Honeywell c300, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-5407, published 2024-04-17.

More from Honeywell.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-5392, published 2024-04-11. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the…
• CVE-2023-5407, published 2024-04-17. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. Controller denial of service due to improper handling of a specially crafted message received by the controller. See Honeywell Security Notification for recommendations on upgrading and versioning.