PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-5390 Honeywell CVE debrief

CVE-2023-5390 is a medium-severity vulnerability (CVSS 5.3) affecting multiple Honeywell industrial control systems including Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager, and Safety Manager SC. Published on April 25, 2024, this vulnerability could allow an attacker to read from Experion controllers or SMSC S300 devices, potentially exposing limited information from the device through file read operations. The vulnerability impacts 16 distinct product versions across Honeywell's industrial automation portfolio, spanning multiple release trains of their distributed control and safety systems. Honeywell has released fixes for all affected versions and advises users to upgrade to the patched versions referenced in their Security Notice.

Vendor
Honeywell
Product
Experion PKS
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-25
Original CVE updated
2024-04-25
Advisory published
2024-04-25
Advisory updated
2024-04-25

Who should care

Organizations operating Honeywell Experion distributed control systems or Safety Manager safety instrumented systems in critical infrastructure sectors including oil and gas, chemicals, power generation, and manufacturing. Asset owners with unpatched versions should prioritize remediation due to network-exploitable information disclosure risk to industrial controllers.

Technical summary

CVE-2023-5390 is an information disclosure vulnerability in Honeywell's industrial control system product suite. The vulnerability allows network-based attackers to read files from Experion controllers and SMSC S300 safety controllers without authentication. Successful exploitation exposes limited device information but does not permit code execution or system modification. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network accessibility, low attack complexity, no privilege requirements, and low confidentiality impact. Affected systems span multiple version branches: Experion PKS releases prior to R510.2 HF14, R511.5 TCU4 HF4, R520.1 TCU5, and R520.2 TCU4 HF2; Experion LX and PlantCruise versions prior to equivalent patch levels; Safety Manager R15x and R16x through R162.10; and Safety Manager SC versions R210.X through R212.1. Honeywell has addressed the vulnerability through security updates available via their technical publication system.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-supplied patches by upgrading to the fixed versions specified in Honeywell Security Notice SN2024 for all affected Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager, and Safety Manager SC
  • Implement network segmentation to restrict access to Experion controllers and SMSC S300 devices from untrusted networks
  • Monitor for unauthorized read operations or anomalous file access attempts on affected Honeywell industrial control systems
  • Review and apply CISA ICS recommended practices for defense-in-depth strategies in industrial control environments
  • Validate that safety instrumented systems (SIS) and safety manager deployments follow vendor hardening guidance

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-24-116-04. Affected product list includes 16 specific versioned products across five Honeywell product families. CVSS 3.1 vector confirms network-accessible, low-complexity attack with no privileges required. Remediation guidance directs users to Honeywell Security Notice SN2024 for specific patch versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-5390 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-5390

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-5390 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-5390

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-116-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-116-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.