Honeywell Tuxedo Touch vulnerabilities

2 CVEs affecting Honeywell Tuxedo Touch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-2848, published 2015-07-26.

More from Honeywell.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-2847, published 2015-07-26. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests…
• CVE-2015-2848, published 2015-07-26. Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with…