RCE in Honeywell Onewireless Network Wireless Device Manager

CVE-2023-5878

Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to R322.3, R330.2 or the most recent version of this product2.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.009 (57.6th percentile) — read the EPSS interpretation.