CVE-2017-5143: An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb...

Security readout for executives and security teams

CVE-2017-5143 affects Honeywell XL Web II and XLWeb 500 controllers. The reported issue lets an unauthenticated user attempt directory traversal through the web interface, potentially exposing files that should not be reachable. The public bundle does not provide CVSS, detailed impact, or confirmed exploitation. Exposure is most likely where affected Honeywell building automation controllers have reachable web management interfaces, especially from untrusted networks. Internet exposure would materially increase risk, but the supplied sources do not quantify deployment prevalence or default exposure. Prioritize if these controllers support critical facility operations or are reachable beyond a tightly controlled management network. The absence of CVSS and KEV evidence lowers certainty, not business relevance. Mitigation focus: Identify affected XL Web II and XLWeb 500 deployments and versions.; Check Honeywell and ICS-CERT advisory guidance for vendor-approved fixes.; Restrict controller web interfaces to trusted management networks only..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.