Skip to content
OpenAdvisories
Critical ICSA-21-278-04 3 CVEs

Honeywell Experion PKS and ACE Controllers

Published Oct 5, 2021 · Updated Oct 5, 2021

Vendor: Honeywell Product: C200 Product: C200E Product: C300 and ACE controllers

Summary

Successful exploitation of these vulnerabilities could lead to remote code execution and denial-of-service conditions.

Vulnerabilities 3

  • Critical 10.0
    CVE-2021-38397

    Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type

    Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

    Honeywell Experion PKS ICS / OT
  • Critical 9.1
    CVE-2021-38395

    Honeywell Experion PKS and ACE Controllers Injection

    Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

    Honeywell Experion PKS ICS / OT
  • High 7.5
    CVE-2021-38399

    Honeywell Experion PKS and ACE Controllers Relative Path Traversal

    Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.

    Honeywell Experion PKS ICS / OT

Revision history

  1. #1

    ICSA-21-278-04 Honeywell Experion PKS and ACE Controllers

References