Security Resilience

CVE-2023-5392

Published
11 April 2024
Modified
15 April 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0048 40th percentile
Risk Priority 58 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-5392 is a high-severity Debug Messages Revealing Unnecessary Information (CWE-1295) vulnerability in Honeywell Security Notification (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-11 (Error Handling) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

C300 information leak due to an analysis feature which allows extracting more memory over the network than required by the function. Honeywell recommends updating to the most recent version of the product. See Honeywell Security Notification for recommendations on upgrading…

more

and versioning.

CWE(s)
CWE-1295

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
attack.mitre.org →
T1020.001 Traffic Duplication Exfiltration
Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-45784Shared CWE-1295
CVE-2025-59109Shared CWE-1295
CVE-2025-31001Shared CWE-1295
CVE-2025-12910Shared CWE-1295
CVE-2025-46775Shared CWE-1295
CVE-2024-27179Shared CWE-1295
CVE-2025-35031Shared CWE-1295
CVE-2025-2877Shared CWE-1295
CVE-2025-42604Shared CWE-1295
CVE-2023-4215Shared CWE-1295

Affected Assets

Honeywell
Security Notification
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V13.4.2

Mitigating Controls (NIST 800-53 r5) AI

SI-11 Error Handling good match

SI-11 requires error messages (including debug/diagnostic output) to avoid exposing exploitable system details, directly stopping the described information leakage.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 partial match
blocks

Configuration baselines can disable debug output in production, partially preventing exposure of sensitive details.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require sanitizing or removing debug messages that leak internal information.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.15 Logging partial match
blocks

A.8.15 records, protects, and analyzes logs (including debug output) but does not stop debug messages from containing or revealing unnecessary sensitive information; the weakness remains present and exploitable.

A.8.26 Application security requirements partial match
removes
A.8.28 Secure coding partial match
prevents

Secure coding practices mandate removal or protection of debug output containing sensitive information before release.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect excessive debug information, but does not guarantee its prevention in production.

A.8.8 Management of technical vulnerabilities partial match
removes
A.8.9 Configuration management partial match
blocks

Configuration management can disable debug flags, providing partial mitigation without covering the control's broader scope.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220967 The Debug programs user right must only be assigned to the Administrators group. blocks CWE-1295
Windows Server 2016 (1 rule)
  • V-225079 The Debug programs user right must only be assigned to the Administrators group. blocks CWE-1295
Windows Server 2019 (1 rule)
  • V-205757 Windows Server 2019 Debug programs: user right must only be assigned to the Administrators group. blocks CWE-1295

References