Honeywell Xl Web Ii Controller vulnerabilities

5 CVEs affecting Honeywell Xl Web Ii Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-5143, published 2017-02-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-5143, published 2017-02-13. High severity, CVSS 8.6. EPSS: 2.3% chance of exploitation in the next 30 days. An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal…
CVE-2017-5140, published 2017-02-13. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text.
CVE-2017-5139, published 2017-02-13. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a…
CVE-2017-5141, published 2017-02-13. Medium severity, CVSS 6.0. EPSS: 1.1% chance of exploitation in the next 30 days. An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without…
CVE-2017-5142, published 2017-02-13. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the…