CVE-2023-3710
📋 TL;DR
This CVE describes a command injection vulnerability in Honeywell PM43 printers' web interface modules. Attackers can execute arbitrary commands on affected printers by sending specially crafted input. This affects PM43 printers running 32-bit or ARM firmware versions before P10.19.050004.
💻 Affected Systems
- Honeywell PM43 industrial printers
📦 What is this software?
Pm43 Firmware by Honeywell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with printer privileges, potentially gaining persistent access, disrupting operations, or using the printer as a pivot point into the network.
Likely Case
Remote code execution leading to printer configuration changes, data exfiltration, or denial of service through printer disruption.
If Mitigated
Limited impact if network segmentation and access controls prevent unauthorized access to printer management interfaces.
🎯 Exploit Status
Command injection vulnerabilities typically have low exploitation complexity when unauthenticated access is available to the vulnerable interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MR19.5 (e.g., P10.19.050006 or later)
Vendor Advisory: https://www.honeywell.com/us/en/product-security
Restart Required: Yes
Instructions:
1. Download the latest firmware from Honeywell's FTP site. 2. Follow Honeywell's firmware update procedure for PM43 printers. 3. Verify the firmware version after update.
🔧 Temporary Workarounds
Network segmentation
allIsolate printer management interfaces from untrusted networks
Access control restrictions
allImplement strict firewall rules to limit access to printer web interfaces
🧯 If You Can't Patch
- Disable or restrict access to the printer web interface entirely
- Implement network monitoring for suspicious traffic to printer management ports
🔍 How to Verify
Check if Vulnerable:
Check printer firmware version via web interface or serial consoleCheck Version:
Check via printer web interface at /status or through serial console commands specific to PM43Verify Fix Applied:
Confirm firmware version is P10.19.050006 or later📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in printer logs
- Multiple failed login attempts to web interface
- Unexpected configuration changes
Network Indicators:
- Suspicious HTTP requests to printer web interface containing shell metacharacters
- Unexpected outbound connections from printer
SIEM Query:
source="printer_logs" AND (event="command_execution" OR event="configuration_change")🔗 References
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
- https://www.honeywell.com/us/en/product-security
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwaresignedP1019050004
- https://hsmftp.honeywell.com:443/en/Software/Printers/Industrial/PM23-PM23c-PM43-PM43c/Current/Firmware/firmwarexasignedP1019050004A
- https://www.honeywell.com/us/en/product-security
