A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• honeywell experion process knowledge systemr400 and later · before r400.6
• honeywell experion process knowledge systemr410 and later · before r410.6
• honeywell experion process knowledge systemr430 and later · before r430.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (icscert). Independent of NVD's CPE analysis and usually ahead of it.

• Honeywell Experion PKS

  • R40x before R400.6, R41x before R410.6, R43x before R430.2affected

Other highest-scoring records for the same primary product.

• CVE-2014-9189Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior t
  41Plan
• CVE-2014-9186A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x bef
  40Plan
• CVE-2014-5435An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6
  40Plan
• CVE-2014-9187Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410
  40Plan
• CVE-2016-8344An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Re
  14Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const file = path.join(ROOT, req.query.name);2res.sendFile(file);

1const file = path.resolve(ROOT, req.query.name);2if (!file.startsWith(ROOT + path.sep)) {3  return res.sendStatus(400);4}5res.sendFile(file);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.