High severity · published Sep 12, 2023
CVE-2023-3711
Potential Predictable Session ID
8.8
CVSS
1%
EPSS
No
On KEV
Description
Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
PC23/43, PD43 · Honeywell
before K10.19.050004 · source: vendor
PP
PD45, PX240 · Honeywell
before F10.19.050004 · source: vendor
PM
PM23/43 · Honeywell
before P10.19.050004 · source: vendor
PM
PM42 · Honeywell
before T10.19.050004; before L10.19.050004 · source: vendor
PM
PM45 · Honeywell
before J10.19.050004 · source: vendor
PX
PX45/65 · Honeywell
before B10.19.050004 · source: vendor
PX
PX4ie/6ie · Honeywell
before A10.19.050004 · source: vendor
PX
PX940 · Honeywell
before H10.19.050004 · source: vendor
RP
RP2f/RP4f · Honeywell
before M10.19.050006 · source: vendor
PF
Pm43 Firmware · Honeywell
before p10.19.050004 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3711
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3711
Permissions Required
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
Permissions Required
https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
Product
https://www.honeywell.com/us/en/product-security
More from PC23/43, PD43
9.8
CVE-2023-3710
Printer web page invalid command execution
7.8
CVE-2023-3712
Potential user privilege escalation