« Volver al listado

CVE-2023-6179

Estado: ModificadaAlta (7.8)—

Honeywell ProWatch 4.5, incluidas todas las versiones de Service Pack, contiene una vulnerabilidad en las carpetas ejecutables del servidor de aplicaciones. Un atacante podría explotar esta vulnerabilidad, lo que llevaría a que un usuario estándar ejecutara código de sistema arbitrario. Honeywell recomienda actualizar a la versión más reciente de este producto, servicio u oferta (Pro-watch 6.0.2, 6.0, 5.5.2, 5.0.5).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Honeywell — Prowatch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6179",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6179",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-03-13T16:13:45.890516Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@honeywell.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@honeywell.com",
      "affectedData": [
        {
          "vendor": "Honeywell",
          "product": "ProWatch",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "status": "unaffected",
              "version": "6.0.2"
            },
            {
              "status": "unaffected",
              "version": "6.0"
            },
            {
              "status": "unaffected",
              "version": "5.5.2"
            },
            {
              "status": "unaffected",
              "version": "5.0.5"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:honeywell:prowatch:*:*:*:*:*:*:*:*"
          ],
          "vendor": "honeywell",
          "product": "prowatch",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.5"
            },
            {
              "status": "affected",
              "version": "5.5.2"
            },
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.0.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-11-17T17:15:08.047",
  "references": [
    {
      "url": "https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices",
      "tags": [
        "Product"
      ],
      "source": "psirt@honeywell.com"
    },
    {
      "url": "https://www.honeywell.com/us/en/product-security",
      "tags": [
        "Not Applicable"
      ],
      "source": "psirt@honeywell.com"
    },
    {
      "url": "https://buildings.honeywell.com/us/en/brands/our-brands/security/support-and-resources/product-resources/eol-and-security-notices",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.honeywell.com/us/en/product-security",
      "tags": [
        "Not Applicable"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@honeywell.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5).\n\n"
    },
    {
      "lang": "es",
      "value": "Honeywell ProWatch 4.5, incluidas todas las versiones de Service Pack, contiene una vulnerabilidad en las carpetas ejecutables del servidor de aplicaciones. Un atacante podría explotar esta vulnerabilidad, lo que llevaría a que un usuario estándar ejecutara código de sistema arbitrario. Honeywell recomienda actualizar a la versión más reciente de este producto, servicio u oferta (Pro-watch 6.0.2, 6.0, 5.5.2, 5.0.5)."
    }
  ],
  "lastModified": "2026-06-17T06:50:15.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:honeywell:prowatch:4.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54087269-1D00-40DA-B97A-5AE2D05EEAC7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@honeywell.com"
}