CVE-2023-3710 EXPLOIT
9.9
CRITICAL · CVSS 3.1 · EPSS 49% (pctl 99)
Patch early
A public exploit exists.
Description
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).
Scoring
| CVSS | 9.9 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H |
| EPSS | 49.04% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2023-09-12 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| honeywell | pm43 |
| honeywell | pm43 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE) | 2024-03-14 |
References
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
- https://www.honeywell.com/us/en/product-security
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
- https://www.honeywell.com/us/en/product-security
→ the Explorer · watch your stack · NVD