CVE-2014-3110: Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04...

Security readout for executives and security teams

CVE-2014-3110 is a set of cross-site scripting flaws in older Honeywell FALCON XLWeb controller devices. An attacker who can reach the device web interface may be able to inject script or HTML into pages viewed by users. The source bundle does not provide CVSS scoring or confirmed active exploitation. Exposure is most likely in environments still operating the named Honeywell FALCON XLWeb controller versions, especially where device web interfaces are reachable from user networks or remote access paths. Internet exposure would raise concern, but the bundle does not state exposure prevalence. Prioritize this as a legacy operational technology exposure review. It is not proven actively exploited in the supplied sources, but public exploit information and controller impact justify prompt inventory, segmentation checks, and vendor-guided remediation. Mitigation focus: Inventory FALCON XLWeb and XLWebExe controllers and record firmware versions.; Review Honeywell and ICS-CERT advisory guidance for supported updates or mitigations.; Restrict controller web interfaces to trusted management networks only..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.