CVE-2014-3110 describes multiple cross-site scripting (XSS) vulnerabilities in Honeywell FALCON XLWeb Linux controller devices (2.04.01 and earlier) and FALCON XLWeb XLWebExe controller devices (2.02.11 and earlier), allowing remote attackers to inject arbitrary web script or HTML through invalid input. With a CVSS score of 4.3, this vulnerability has a network attack vector and medium attack complexity, potentially leading to information disclosure (partial impact) without requiring authentication. While not listed in CISA's KEV catalog, an ExploitDB entry (EDB-44749) exists, indicating public exploit code. Despite this, there is no evidence of active exploitation, and community discussion and media coverage remain minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.04.01CPE matchmatch criteria | cpe:2.3:h:honeywell:falcon_xlweb_linux_controller:*:*:*:*:*:*:*:* | ||
<= 2.02.11CPE matchmatch criteria | cpe:2.3:h:honeywell:falcon_xlweb_xlwebexe:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.