CVE-2015-0984 is a directory traversal flaw (CWE-22) in the FTP server built into Honeywell's Excel Web XL1000 line of building automation controllers: a remote, unauthenticated attacker can send a crafted FTP pathname to read files under the controller's web root, including files that expose administrative web-interface login credentials, and NVD rates this 10.0 (the maximum score) on CVSS v2.0.
Vulnerability summary
10
Critical
5.6%
EPSS score (FIRST)
No
CISA KEV catalog
2015-03-31
Published
Vulnerability ID: CVE-2015-0984 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Honeywell Excel Web XL1000 building automation controllers | cpe:2.3:a:honeywell:excel_web_xl1000c50_firmware:*:*:*:*:*:*:*:* | All eight XL1000 FTP-enabled variants (XL1000C50, C100, C500, C1000, and their 'U'/UUKL variants) with firmware before 2.04.01; fixed in Excel Web Linux 2.04.01 with CARE programming tool 10.02 (both March 2014), per Honeywell's advisory |
What does this mean for affected devices?
CVE-2015-0984 affects Honeywell's Excel Web XL1000 series, a line of BACnet-capable building automation controllers used to manage HVAC and building-wide control sequences. NVD's description states: "Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, and UUKL variants of each, before 2.04.01 allows remote attackers to read arbitrary files via a crafted pathname, which allows remote attackers to obtain administrative login access via unspecified vectors" (NVD).
NVD records a Primary CVSS v2.0 base score of 10.0 — the maximum possible score — under vector AV:N/AC:L/Au:N/C:C/I:C/A:C: network-reachable, low attack complexity, no authentication required, with complete compromise of confidentiality, integrity and availability; no CVSS v3 score has been published for this 2015-era CVE (NVD). NVD's CPE applicability data lists all eight affected XL1000 variants (the C50, C100, C500 and C1000 I/O-count models, each with a standard and a UUKL build) with the vulnerable range ending at firmware 2.04.00, i.e. every build before 2.04.01 (NVD).
The flaw is documented in CISA's ICS advisory ICSA-15-076-02 ("Honeywell XL Web Controller Directory Traversal Vulnerability"), which NVD lists as a Third Party Advisory / US Government Resource reference; the advisory records Honeywell's fix as Excel Web Linux firmware version 2.04.01 (released March 2014) together with CARE programming tool version 10.02, and directs affected sites to their local Honeywell building-solutions branch for the update (CISA ICSA-15-076-02). Security researchers at Outpost24 separately documented exploitation of this class of Excel Web FTP traversal flaw against an internet-facing XL1000 controller as part of a public case study, and the issue was also disclosed on the Full Disclosure mailing list (Outpost24, Full Disclosure).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, but FIRST scores the probability of exploitation at 0.0561 (92.97th percentile) as of 2026-11-08 — markedly higher than most CVEs in this lane, consistent with the controller's FTP server being directly reachable without authentication (CISA KEV, FIRST EPSS).
Any Excel Web XL1000 controller still running firmware before 2.04.01 should be updated per Honeywell's advisory, and its FTP service should not be exposed to the public internet in the meantime.
Evidence
- Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000 controllers (all eight variants) before 2.04.01 allows remote attackers to read arbitrary files via a crafted pathname and obtain administrative login access. — NVD
- NVD Primary CVSS v2.0 base score is 10.0 (maximum), vector AV:N/AC:L/Au:N/C:C/I:C/A:C; no CVSS v3 score published. CPE data scopes all eight XL1000 variants to firmware builds ending at 2.04.00. — NVD
- Documented in CISA ICS advisory ICSA-15-076-02; Honeywell's fix is Excel Web Linux firmware 2.04.01 with CARE programming tool 10.02, both released March 2014. — CISA ICSA-15-076-02
- Outpost24 documented exploitation of this FTP directory traversal class against an internet-facing Excel Web XL1000 controller in a public case study. — Outpost24
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0561 (92.97th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can a remote attacker read without any credentials on a vulnerable XL1000 controller?
By sending a crafted pathname to the controller's FTP server, an unauthenticated remote attacker can read arbitrary files under the web root, including files that expose administrative web-interface login credentials, giving the attacker a path from anonymous FTP access to full admin control of the controller (per NVD).
Which specific Excel Web XL1000 models and firmware versions are affected?
NVD's CPE applicability data lists all eight affected variants — the XL1000C50, C100, C500 and C1000 I/O-count models, each in a standard and a UUKL build — with every firmware build before 2.04.01 vulnerable (per NVD; per CISA ICSA-15-076-02).
Has this directory traversal flaw actually been exploited against real controllers?
Yes. Security researchers at Outpost24 documented exploitation of this class of Excel Web FTP traversal flaw against an internet-facing XL1000 controller in a public case study, and it was also disclosed on the Full Disclosure mailing list; it is not in the CISA KEV catalog, but FIRST's EPSS model places it at the 92.97th percentile for exploitation probability as of 2026-11-08 (per Outpost24; per FIRST EPSS).
How do you remediate a vulnerable Excel Web XL1000 controller?
Honeywell's fix is Excel Web Linux firmware version 2.04.01, released together with CARE programming tool version 10.02 in March 2014; CISA's ICS advisory directs affected sites to their local Honeywell building-solutions branch for the update, and recommends the FTP service not be exposed to the public internet in the meantime (per CISA ICSA-15-076-02).