Vulnerability in Honeywell Tuxedo Touch

CVE-2015-2847

Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.

Affected products

Honeywell Tuxedo_touch
N/a — versions n/a

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)