CVE-2017-5143

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior

Description A directory traversal attack can be made by accessing a specific URL without authenticating.

Recommendations For Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior, restrict access to the specific URL that allows directory traversal attacks until a patch is available. For Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior, restrict access to the specific URL that allows directory traversal attacks until a patch is available.