Login Request a demo
Critical severity · published Sep 12, 2023
CVE-2023-3710
Printer web page invalid command execution
9.8
CVSS
49%
EPSS
No
On KEV
Description
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)49.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
PC23/43, PD43 · Honeywell
before K10.19.050004 · source: vendor
PP
PD45, PX240 · Honeywell
before F10.19.050004 · source: vendor
PM
PM23/43 · Honeywell
before P10.19.050004 · source: vendor
PM
PM42 · Honeywell
before T10.19.050004; before L10.19.050004 · source: vendor, CISA
PM
PM45 · Honeywell
before J10.19.050004 · source: vendor, CISA
PX
PX45/65 · Honeywell
before B10.19.050004 · source: vendor
PX
PX4ie/6ie · Honeywell
before A10.19.050004 · source: vendor
PX
PX940 · Honeywell
before H10.19.050004 · source: vendor, CISA
RP
RP2f/RP4f · Honeywell
before M10.19.050006 · source: vendor
PF
Pm43 Firmware · Honeywell
before p10.19.050004 · source: NVD
P4
Pc23 43 · Honeywell
before K10.19.050004 · source: CISA
PD
Pd43 · Honeywell
before K10.19.050004 · source: CISA
Affected product
PP
PC23/43, PD43
Honeywell
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3710
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3710
Permissions Required
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
Permissions Required
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
Product
https://www.honeywell.com/us/en/product-security
More from PC23/43, PD43
8.8
CVE-2023-3711
Potential Predictable Session ID
7.8
CVE-2023-3712
Potential user privilege escalation