CVE-2023-5389 is a critical (CVSS 9.1) flaw in Honeywell Experion ControlEdge UOC and ControlEdge VirtualUOC that could let an attacker modify files on the controller. Honeywell recommends updating to the most recent product version, so read its security notification for the versions that apply to you.
What's affected
The NVD record says an attacker could potentially exploit this vulnerability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. The exploit could write a file that causes unexpected behavior from configuration changes or file updates, and could result in the later execution of a malicious application if triggered.
The record says Honeywell recommends updating to the most recent version and refers to the Honeywell Security Notification for upgrade and version guidance. The references are the Honeywell process solutions site and its product security page, which are general entry points, so we cannot quote a fixed version. Download the notice from the Honeywell portal with your customer account.
The record lists the ControlEdge Unit Operations Controller and the virtual variant, with their firmware, as affected products.
How to check if you're exposed
Find every ControlEdge UOC and VirtualUOC in your plant or lab inventory, and note the software version from the Experion or controller management tools.
Compare the versions with the Honeywell Security Notification for this CVE.
Review network design. Control system networks should be segmented from business networks, with controlled and logged paths in between.
Check change management logs for file or configuration changes on the controllers that nobody scheduled.
What to do now
- Get the Honeywell Security Notification for CVE-2023-5389 from the Honeywell portal.
- Plan the upgrade with your control system engineers, and test it in a staging system where you have one.
- Restrict network access to the controllers to engineering stations and required servers.
- Review controller configuration and file integrity against a known good baseline.
- Monitor for unexpected file changes and unplanned controller restarts.
Why it matters
The record maps this to CWE-749, exposed dangerous method or function. An interface lets a caller write or replace files on the controller, which means the file system is reachable by something that should not be able to change it.
Controllers run physical processes, so integrity matters more than almost anything else. A modified file that runs later can change how a process behaves. The record gives few technical details, so this post stays at that level. It does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Where do I find the fixed version?
The record points to the Honeywell Security Notification and says to update to the most recent version. Get the notice from the Honeywell portal for exact versions.
Sources
Last reviewed: 19 October 2026.
