PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5139 Honeywell CVE debrief

CVE-2017-5139 is a critical Honeywell XL Web II controller issue where a password can be disclosed by accessing a specific URL. NVD classifies the weakness as CWE-522 (insufficiently protected credentials) and rates the issue CVSS 3.0 9.8, reflecting network accessibility, no required privileges, no user interaction, and high impact to confidentiality, integrity, and availability. The affected products listed by NVD are XLWebExe-2-01-00 and prior for XL1000C500, and XLWebExe-1-02-08 and prior for XLWeb 500.

Vendor
Honeywell
Product
Unknown
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-02
Original CVE updated
2017-02-02
Advisory published
2017-02-02
Advisory updated
2017-02-02

Who should care

OT/ICS operators, control-system administrators, plant security teams, and incident responders responsible for Honeywell XL Web II controller deployments should treat this as high priority, especially where the web interface is reachable from broader operational or enterprise networks.

Technical summary

NVD states that any user can disclose a password by accessing a specific URL, with the underlying weakness identified as plaintext storage of a password / insufficient protection of credentials. The official NVD entry lists affected Honeywell XL Web II controller CPEs for XLWebExe-2-01-00 and prior, and XLWebExe-1-02-08 and prior. The recorded CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Immediate

Recommended defensive actions

  • Identify all Honeywell XL Web II controller deployments and confirm whether they run XLWebExe-2-01-00 or earlier, or XLWebExe-1-02-08 or earlier.
  • Apply Honeywell and ICS-CERT guidance from the referenced advisories, and move to a non-affected controller/software release if available.
  • Restrict network access to the controller web interface so only authorized management hosts can reach it.
  • Rotate any credentials that may have been exposed and review access to the controller management interface for suspicious retrieval of the affected URL.
  • Segment OT assets from enterprise networks and enforce least-privilege access to reduce the blast radius of credential disclosure.

Evidence notes

All statements are based on the supplied NVD record, CVE record link, and the referenced ICS-CERT / US-CERT advisory URLs. The NVD entry explicitly lists the affected Honeywell versions, the CWE-522 weakness, and the CVSS 3.0 vector 9.8. No exploit steps or unsupported remediation claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5139 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5139

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5139 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5139

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.