Server receiving a malformed message that causes a disconnect to a hostname may causing a…
Priority LOW 34CWE-130Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code execution. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading and versioning.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00711 53rd percentileScored 2026-11-07
Fix Fixed Experion Server (Honeywell): 520.2, 510.1, 520.1 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Honeywell | Experion Server | — | 520.2, 510.1, 520.1, 511.1 | Patch available | CNA |
| Honeywell | Experion Server | 520.2 – 520.2 TCU4; 511.1 – 511.5 TCU4 HF3; 520.1 – 520.1 TCU4 | — | No fix listed | CNA |
| Honeywell | Experion Server | 520.2 – 520.2 TCU4; 520.1 – 520.1 TCU4; 520.2 TCU4 HFR2 – 511.5 TCU4 HF3 | — | No fix listed | CNA |
- Experion Server VendorHoneywell Affected — Fixed in 520.2, 510.1, 520.1, 511.1 Patch available CNA
- Experion Server VendorHoneywell Affected 520.2 – 520.2 TCU4; 511.1 – 511.5 TCU4 HF3; 520.1 – 520.1 TCU4 Fixed in — No fix listed CNA
- Experion Server VendorHoneywell Affected 520.2 – 520.2 TCU4; 520.1 – 520.1 TCU4; 520.2 TCU4 HFR2 – 511.5 TCU4 HF3 Fixed in — No fix listed CNA
Remediation
- Fix · CNA Experion Server (Honeywell) Fixed in 520.2, 510.1, 520.1, 511.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5393
- 2026-10-03 Alias added: GHSA-3876-9wf2-9986
References
More Honeywell vulnerabilities
- TI-2023-03466 Printer web page invalid command execution CVSS 3.1CRITICAL 9.9
- TI-2021-22482 WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path CVSS 4.0HIGH 8.5
- TI-2021-22480 WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path CVSS 4.0HIGH 8.5
- TI-2007-02844 Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module… CVSS 2.0HIGH 10.0
- TI-2023-18324 MAS (a Carrier brand) MASmobile Classic Authorization Bypass CVSS 3.1MEDIUM 6.5
- TI-2023-28253 XML external entity injection in Honeywell Saia PG5 Controls Suite CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-5393 · CVE Program
- CVE-2023-5393 · NVD
- FIRST EPSS
- GHSA-3876-9wf2-9986 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences