PatchSiren cyber security CVE debrief

CVE-2023-5401 Honeywell CVE debrief

CVE-2023-5401 is a HIGH severity vulnerability (CVSS 3.1: 8.1) affecting multiple Honeywell industrial control systems including Experion PKS, Experion LX, PlantCruise by Experion, Safety Manager, and Safety Manager SC. Published on April 25, 2024, this vulnerability enables remote attackers to cause denial-of-service conditions or achieve remote code execution on Experion Servers or Stations through specially crafted network messages. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction. Sixteen distinct product versions are affected across Honeywell's industrial automation portfolio, spanning distributed control systems (Experion PKS, Experion LX, PlantCruise) and safety instrumented systems (Safety Manager, Safety Manager SC). Honeywell has released security updates to address these vulnerabilities. Organizations operating affected systems should prioritize patching given the potential for remote code execution in industrial control environments.

Vendor: Honeywell
Product: Experion PKS
CVSS: HIGH 8.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-04-25
Original CVE updated: 2024-04-25
Advisory published: 2024-04-25
Advisory updated: 2024-04-25

Who should care

Organizations operating Honeywell Experion distributed control systems or Safety Manager safety instrumented systems in critical infrastructure sectors including oil and gas, chemicals, power generation, pharmaceuticals, and manufacturing. Asset owners with Experion Servers or Stations accessible from operational networks should prioritize assessment. Safety engineers responsible for Safety Manager and Safety Manager SC configurations must evaluate patch applicability during safety system maintenance planning. ICS security teams monitoring OT networks for anomalous activity should include these systems in threat hunting scope.

Technical summary

CVE-2023-5401 encompasses vulnerabilities in Honeywell's Experion distributed control systems and Safety Manager safety instrumented systems. The vulnerabilities exist in the message handling implementations of Experion Servers and Stations, where insufficient validation of network messages allows attackers to trigger denial-of-service conditions or execute arbitrary code. The CVSS 3.1 score of 8.1 reflects network attackability, high complexity, and complete confidentiality, integrity, and availability impacts. Affected versions span multiple release trains: Experion PKS versions prior to R510.2 HF14, R511.5 TCU4 HF4, R520.1 TCU5, and R520.2 TCU4 HF2; Experion LX and PlantCruise versions prior to R511.5 TCU4 HF4, R520.1 TCU5, and R520.2 TCU4 HF2; Safety Manager R15x and R16x through R162.10; and Safety Manager SC versions R210.X, R211.1, R211.2, and R212.1. The safety system exposures are particularly critical given their role in process safety shutdown functions.

Defensive priority

HIGH

Recommended defensive actions

Apply Honeywell security updates referenced in Security Notice SN2024 to all affected Experion PKS, Experion LX, PlantCruise, Safety Manager, and Safety Manager SC systems
Prioritize patching of Experion Servers and Stations exposed to network access
Implement network segmentation to isolate affected industrial control systems from untrusted networks
Monitor for anomalous network traffic targeting Experion systems, particularly specially crafted messages
Review and apply CISA ICS recommended practices for defense-in-depth strategies
Ensure safety instrumented systems (Safety Manager, Safety Manager SC) are patched during planned maintenance windows to maintain safety integrity
Verify patch levels against Honeywell's security notice to confirm remediation coverage across all 16 affected product configurations

Evidence notes

CVE published and modified 2024-04-25. CISA ICS advisory ICSA-24-116-04 issued same date. CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Affects 16 product configurations across 5 product families. Not listed in CISA KEV catalog.

Sources and references

Verified primary and authoritative sources

CVE-2023-5401 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2023-5401

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2023-5401 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-5401

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-116-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-116-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.