Server Data type confusion - info leak

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• honeywell direct station520.1 and later · up to 520.1tcu4 inclusive
• honeywell direct station510.1 and later · up to 511.tcu3 inclusive
• honeywell direct station520.2 and later · up to 520.2tcu2 inclusive
• honeywell engineering station520.2 and later · up to 520.2tcu2 inclusive
• honeywell engineering station520.1 and later · up to 520.1tcu4 inclusive
• honeywell engineering station510.1 and later · up to 511.tcu3 inclusive
• honeywell experion server501.1 and later · up to 501.6hf8 inclusive
• honeywell experion server510.1 and later · up to 510.2hf12 inclusive
• honeywell experion server511.1 and later · up to 511.5tcu3 inclusive
• honeywell experion server520.1 and later · up to 520.1tcu4 inclusive
• honeywell experion server520.2 and later · up to 520.2tcu2 inclusive
• honeywell experion station520.2 and later · up to 520.2tcu2 inclusive
• honeywell experion station520.1 and later · up to 520.1tcu4 inclusive
• honeywell experion station511.1 and later · up to 511.5tcu3 inclusive
• honeywell experion station510.1 and later · up to 510.2hf12 inclusive
• honeywell experion station501.1 and later · up to 501.6hf8 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Honeywell). Independent of NVD's CPE analysis and usually ahead of it.

• Honeywell Direct Station

  • 510.5 and later · up to and including 511.5TCU3affected · semver
  • 520.1 and later · up to and including 520.1TCU4affected · semver
  • 520.2 and later · up to and including 520.2TCU2affected · semver

• Honeywell Engineering Station

  • 510.1 and later · up to and including 511.5TCU3affected · semver
  • 520.1 and later · up to and including 520.1TCU4affected · semver
  • 520.2 and later · up to and including 520.2TCU2affected · semver

• Honeywell Experion Server

  • 501.1 and later · up to and including 501.6HF8affected · semver
  • 510.1 and later · up to and including 510.2HF12affected · semver
  • 511.1 and later · up to and including 511.5TCU3affected · semver
  • 520.1 and later · up to and including 520.1TCU4affected · semver
  • 520.2 and later · up to and including 520.2TCU2affected · semver

• Honeywell Experion Station

  • 501.1 and later · up to and including 501.6HF8affected · semver
  • 510.1 and later · up to and including 510.2HF12affected · semver
  • 511.1 and later · up to and including 511.5TCU3affected · semver
  • 520.1 and later · up to and including 520.1TCU4affected · semver
  • 520.2 and later · up to and including 520.2TCU2affected · semver

Other highest-scoring records for the same primary product.

• CVE-2023-5404Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure.
  32Monitor
• CVE-2023-5403Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure
  32Monitor
• CVE-2023-5401Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to
  32Monitor
• CVE-2023-5400Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to a
  32Monitor
• CVE-2023-5397Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a fail
  32Monitor
• CVE-2023-5395Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote cod
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.