CVE-2017-5141

CVE-2017-5141 is a session fixation vulnerability affecting Honeywell XL Web II controller XL1000C500 (XLWebExe-2-01-00 and prior) and XLWeb 500 (XLWebExe-1-02-08 and prior). This allows an attacker to establish a new user session without invalidating existing session identifiers, enabling the theft of authenticated sessions. Rated as Medium severity (CVSS 6.0), it requires high privileges for exploitation (PR:H) but has low attack complexity (AC:L), potentially leading to high confidentiality impact and low integrity/availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion, though it did receive limited media coverage.