OTPulse
FeedAboutContact

Honeywell EBI, SymmetrE, and ComfortPoint Open Manager Station

Act NowICS-CERT ICSA-13-053-02ANov 26, 2013
Summary

Honeywell EBI, SymmetrE, and ComfortPoint Open Manager Station (CPO-M) contain an input validation flaw (CWE-20) that allows processing of improperly formatted data. Affected versions: EBI R310, R400.2, R410.1, R410.2; SymmetrE R310, R410.1, R410.2; CPO-M R100. The vulnerability could allow an attacker to bypass security controls or cause unexpected application behavior through malformed input.

What this means
What could happen
An attacker could send malformed input to bypass validation checks on the EBI, SymmetrE, or CPO-M stations, potentially gaining unauthorized access or causing unexpected behavior in building automation and HVAC control systems.
Who's at risk
Building automation and HVAC system operators relying on Honeywell EBI, SymmetrE, or ComfortPoint Open Manager Station (CPO-M) for facility control. This includes facility managers and operators at commercial buildings, hospitals, data centers, and other enterprises with Honeywell building management systems.
How it could be exploited
An attacker sends specially crafted input data to the affected application (EBI, SymmetrE, or CPO-M) that bypasses input validation due to improper handling of unexpected data formats. This could allow the attacker to execute commands, modify system settings, or disrupt building automation processes.
Prerequisites
  • Network access to the EBI, SymmetrE, or CPO-M application interface
  • Ability to send input to the affected device or application
No patch availableInput validation bypassEPSS score >50%Affects building automation and facility control systems
Exploitability
High exploit probability (EPSS 61.4%)
Affected products (3)
1 pending2 EOL
ProductAffected VersionsFix Status
CPO-M: R100R100No fix yet
EBI: R310|R400.2|R410.1|R410.2R310|R400.2|R410.1|R410.2No fix (EOL)
SymmetrE: R310|R410.1|R410.2R310|R410.1|R410.2No fix (EOL)
Remediation & Mitigation
0/4
Do now
0/2
WORKAROUNDMonitor and filter network traffic to these systems for anomalous input patterns or known attack signatures
WORKAROUNDDisable or restrict access to management interfaces if not actively in use
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXContact Honeywell to determine if patched versions are available despite the advisory indicating no fix
Mitigations - no patch available
0/1
The following products have reached End of Life with no planned fix: EBI: R310|R400.2|R410.1|R410.2, SymmetrE: R310|R410.1|R410.2. Apply the following compensating controls:
HARDENINGImplement network segmentation to restrict access to EBI, SymmetrE, and CPO-M stations from untrusted networks
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/0a46e5b3-97cb-42c7-b57a-f8d183c5790c