An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xl_web_ii_controller | Honeywell | xlwebexe-1-02-08 (including) | xlwebexe-1-02-08 (including) |
| Xl_web_ii_controller | Honeywell | xlwebexe-2-01-00 (including) | xlwebexe-2-01-00 (including) |