CVE-2015-0984
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O...
Affects 16 products across 1 vendor.
Attacker manipulates file path inputs to access files outside the intended directory.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A directory traversal vulnerability exists in the FTP server of Honeywell Excel Web XL1000 series controllers, allowing remote attackers to read files under the web root and potentially gain administrative access. This vulnerability has a CVSS score of 10.0, indicating critical severity.
BSID: BS-2015-GLOBAL-263098-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2015-0984?
What is the CVSS score for CVE-2015-0984?
Is CVE-2015-0984 actively exploited?
How do I remediate CVE-2015-0984?
What systems are affected by CVE-2015-0984?
What NERC-CIP standard applies to CVE-2015-0984?
What IEC 62443 requirement maps to CVE-2015-0984?
| CVE ID | CVE-2015-0984 |
|---|---|
| BSID | BS-2015-GLOBAL-263098-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2015-03-31 |
| Last Modified | 2026-05-06 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.
Source: NIST NVD / MITRE CVE Database
The vulnerability can be exploited by sending a crafted pathname to the FTP server, which allows an attacker to traverse directories and read files that should not be accessible. This can lead to the exposure of sensitive information and administrative credentials.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Fixed Version |
|---|---|---|
| Honeywell | Excel Web Xl 1000C100 104 I\/O | — |
| Honeywell | Excel Web Xl 1000C1000 600 I\/O | — |
| Honeywell | Excel Web Xl 1000C1000 600 I\/O Uukl | — |
| Honeywell | Excel Web Xl 1000C100U 104 I\/O Uukl | — |
| Honeywell | Excel Web Xl 1000C50 52 I\/O | — |
| Honeywell | Excel Web Xl 1000C500 300 I\/O | — |
| Honeywell | Excel Web Xl 1000C500 300 I\/O Uukl | — |
| Honeywell | Excel Web Xl 1000C50U 52 I\/O Uukl | — |
| Honeywell | Excel Web Xl 1000C1000 600 I/O | — |
| Honeywell | Excel Web Xl 1000C1000 600 I/O Uukl | — |
| Honeywell | Excel Web Xl 1000C100 104 I/O | — |
| Honeywell | Excel Web Xl 1000C100U 104 I/O Uukl | — |
| Honeywell | Excel Web Xl 1000C500 300 I/O | — |
| Honeywell | Excel Web Xl 1000C500 300 I/O Uukl | — |
| Honeywell | Excel Web Xl 1000C50 52 I/O | — |
| Honeywell | Excel Web Xl 1000C50U 52 I/O Uukl | — |
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement network segmentation to isolate the FTP server from untrusted networks. Use firewall rules to restrict access to the FTP service only to trusted IP addresses.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. SAGE only publishes a network rule when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 because it allows unauthorized access to control system devices, which could compromise the security of the electronic security perimeter.
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to gain unauthorized access to the control system, which is a critical security concern for IEC 62443 compliance.
Virtual patch generated by CITED Relevance SAGE. Validate in isolated environment before production deployment. Compensating control only - does not replace vendor patch.
SAGE Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 32982649a7d6eabf95b6c5cf3745f419f108630eae0ff099f3fd93dc4e26dea493ed53229a3a5a50766a8843b1c86bddbd75f877ed2bba79d6a0befc4b80b915 |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Check Your Assets Free →