CVE-2015-0984: Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104...

Security readout for executives and security teams

This CVE affects specific Honeywell Excel Web XL1000C controllers. A remote attacker could use a directory traversal flaw in the FTP server to read web-root files and potentially obtain administrative login access. That makes exposed building-control systems a serious operational risk, even though the bundle does not show confirmed active exploitation. Exposure is most likely where affected Excel Web XL1000C controllers run firmware before 2.04.01 and FTP is reachable from untrusted networks. Internet-facing or broadly reachable building-automation networks should be prioritized. The bundle does not identify other affected Honeywell products. Treat this as high priority for facilities, OT, and building-management environments. The issue can expose administrative access on industrial controllers, but urgency depends on whether affected devices are deployed and reachable. Start with inventory and network exposure checks. Mitigation focus: Identify affected XL1000C controller models and firmware versions.; Check Honeywell and CISA guidance for the approved remediation path.; Update affected controllers to 2.04.01 or later where vendor-supported..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.