CVE-2013-0108

medium · 6.8

An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.

6.8

CVSS

26.6%

EPSS (exploit prob.)

98th

EPSS percentile

2013-02-24

Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
honeywell	enterprise_buildings_integrator	r310
honeywell	enterprise_buildings_integrator	r400.2
honeywell	enterprise_buildings_integrator	r410.1
honeywell	enterprise_buildings_integrator	r410.2
honeywell	symmetre	r310
honeywell	symmetre	r400.2
honeywell	symmetre	r410.1
honeywell	comfortpoint_open_manager_station	r100

Check a specific version with /api/v1/cve/match.

References

http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf
http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0108