Mageni Mageni Security LLC

Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Honeywell Falcon XL Web Controller Directory Traversal Vulnerability

Information

Severity

Severity

Critical

Family

Family

FTP

CVSSv2 Base

CVSSv2 Base

10.0

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Solution Type

Solution Type

Vendor Patch

Created

Created

8 years ago

Modified

Modified

4 years ago

Share

Summary

The host is installed with Honeywell Falcon XL Web Controller and is prone to directory traversal vulnerability.

Insight

Insight

Flaw exists due to the FTP server not properly sanitizing user input, specifically path traversal style attacks.

Affected Software

Affected Software

XL1000C50-EXCEL WEB 52 I/O before 2.04.01 XL1000C100-EXCEL WEB 104 I/O before 2.04.01 XL1000C500-EXCEL WEB 300 I/O before 2.04.01 XL1000C1000-EXCEL WEB 600 I/O before 2.04.01 XL1000C50U-EXCEL WEB 52 I/O UUKL before 2.04.01 XL1000C100U-EXCEL WEB 104 I/O UUKL before 2.04.01 XL1000C500U-EXCEL WEB 300 I/O UUKL before 2.04.01 XL1000C1000U-EXCEL WEB 600 I/O UUKL before 2.04.01

Detection Method

Detection Method

Send a crafted data via HTTP POST request and check whether it is able to read local file or not.

Solution

Solution

Upgrade to EXCEL WEB to version 2.04.01 or later.

Common Vulnerabilities and Exposures (CVE)

References