CVE-2023-3710criticalobserved exploitationCWE-20

CVE-2023-3710: critical vulnerability in Honeywell PC23/43, PD43

Printer web page invalid command execution

Published · Updated

Follow this CVE+ Monitor PC23/43, PD43+ Monitor PD45, PX240

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

97Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.9epss 49%
from disclosure to weaponsame day
Published on NVDSep 12
1st PoCJul 3
VulnCheck+147d
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
Affected products
Honeywell · PC23/43, PD43Honeywell · PD45, PX240Honeywell · PM23/43Honeywell · PM42Honeywell · PM45Honeywell · PX45/65Honeywell · PX4ie/6ieHoneywell · PX940Honeywell · RP2f/RP4f
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Honeywell PC23/43, PD43

In the same product, most dangerous first.

CVE-2023-3711MEDIUMPotential Predictable Session IDEPSS 1.0%CVE-2023-3712MEDIUMPotential user privilege escalationEPSS 0.6%