Read the docs
TI-2023-03468 Aliases CVE-2023-3712GHSA-cwj7-4q2c-hmxj

Potential user privilege escalation

Priority LOW 35CWE-552Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-552.

Summary

Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004.  Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00552 46th percentileScored 2026-11-07
Fix Fixed PM23/43 (Honeywell): P10.19.050004PC23/43, PD43 (Honeywell): K10.19.050004+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HoneywellPM23/43before P10.19.050004P10.19.050004Patch availableCNA
HoneywellPC23/43, PD43before K10.19.050004K10.19.050004Patch availableCNA
HoneywellPM42before T10.19.050004T10.19.050004Patch availableCNA
HoneywellPM42before L10.19.050004L10.19.050004Patch availableCNA
HoneywellPX4ie/6iebefore A10.19.050004A10.19.050004Patch availableCNA
HoneywellPX45/65before B10.19.050004B10.19.050004Patch availableCNA
HoneywellPD45, PX240before F10.19.050004F10.19.050004Patch availableCNA
HoneywellPX940before H10.19.050004H10.19.050004Patch availableCNA
HoneywellPM45before J10.19.050004J10.19.050004Patch availableCNA
HoneywellRP2f/RP4fbefore M10.19.050006M10.19.050006Patch availableCNA
  • PM23/43 VendorHoneywell Affected before P10.19.050004 Fixed in P10.19.050004 Patch available CNA
  • PC23/43, PD43 VendorHoneywell Affected before K10.19.050004 Fixed in K10.19.050004 Patch available CNA
  • PM42 VendorHoneywell Affected before T10.19.050004 Fixed in T10.19.050004 Patch available CNA
  • PM42 VendorHoneywell Affected before L10.19.050004 Fixed in L10.19.050004 Patch available CNA
  • PX4ie/6ie VendorHoneywell Affected before A10.19.050004 Fixed in A10.19.050004 Patch available CNA
  • PX45/65 VendorHoneywell Affected before B10.19.050004 Fixed in B10.19.050004 Patch available CNA
  • PD45, PX240 VendorHoneywell Affected before F10.19.050004 Fixed in F10.19.050004 Patch available CNA
  • PX940 VendorHoneywell Affected before H10.19.050004 Fixed in H10.19.050004 Patch available CNA
  • PM45 VendorHoneywell Affected before J10.19.050004 Fixed in J10.19.050004 Patch available CNA
  • RP2f/RP4f VendorHoneywell Affected before M10.19.050006 Fixed in M10.19.050006 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:honeywell:pm43_firmware:*:*:*:*:*:*:*:*before p10.19.050004VulnerableHoneywell
cpe:2.3:h:honeywell:pm43:-:*:*:*:*:*:x86:*not specified by NVDRunning onHoneywell
  • cpe:2.3:o:honeywell:pm43_firmware:*:*:*:*:*:*:*:* Versions before p10.19.050004 Vulnerable ·Honeywell
  • cpe:2.3:h:honeywell:pm43:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Honeywell

Remediation

  • Fix · CNA PM23/43 (Honeywell) Fixed in P10.19.050004
  • Fix · CNA PC23/43, PD43 (Honeywell) Fixed in K10.19.050004
  • Fix · CNA PM42 (Honeywell) Fixed in T10.19.050004
  • Fix · CNA PM42 (Honeywell) Fixed in L10.19.050004
  • Fix · CNA PX4ie/6ie (Honeywell) Fixed in A10.19.050004
  • Fix · CNA PX45/65 (Honeywell) Fixed in B10.19.050004
  • Fix · CNA PD45, PX240 (Honeywell) Fixed in F10.19.050004
  • Fix · CNA PX940 (Honeywell) Fixed in H10.19.050004
  • Fix · CNA PM45 (Honeywell) Fixed in J10.19.050004
  • Fix · CNA RP2f/RP4f (Honeywell) Fixed in M10.19.050006

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Honeywell PC23/43, PD43, PD45, PX240 and 7 more products A10.19.050004, B10.19.050004 and 8 more versions

    3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2023-03466 Printer web page invalid command executionPriority HIGH 79
    • TI-2023-03467 Potential Predictable Session IDPriority MEDIUM 40
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3712
  2. 2026-10-03 Alias added: GHSA-cwj7-4q2c-hmxj

References

Other 3

  • TI-2023-03466 Printer web page invalid command execution CVSS 3.1CRITICAL 9.9
  • TI-2023-03467 Potential Predictable Session ID CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences