CVE-2023-5396 - Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution

Back Back to CVE browser

HIGH

Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution

Published Apr 17, 2024

7.4

HIGH

CVSS 3.1

EPSS 0.71%

Description

Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning.

Affected products

Vendor Honeywell Product Experion Server Default
unaffected
- Version
  510.1
  Status
  affected
  Constraints
  <=510.2 HF13
- Version
  511.1
  Status
  affected
  Constraints
  <=511.5 TCU4 HF3
- Version
  520.1
  Status
  affected
  Constraints
  <=520.1 TCU4
- Version
  520.2
  Status
  affected
  Constraints
  <=520.2 TCU4
- Version
  520.2 TCU4 HFR2
  Status
  affected
  Constraints
  <=511.5 TCU4 HF3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Honeywell

Experion Server

unaffected

Version	Status	Constraints
510.1	affected	<=510.2 HF13
511.1	affected	<=511.5 TCU4 HF3
520.1	affected	<=520.1 TCU4
520.2	affected	<=520.2 TCU4
520.2 TCU4 HFR2	affected	<=511.5 TCU4 HF3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-805

References (1)

https://process.honeywell.com

Link	Providers	Tags
https://process.honeywell.com

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Honeywell

Published Apr 17, 2024

Updated Aug 2, 2024

Reserved Oct 4, 2023

Link CVE-2023-5396

CISA Vulnrichment

Updated Apr 25, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2023-5396

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-5396