PT-2021-4325 · Honeywell · Honeywell Experion Pks

Published 2021-10-06 · Updated 2022-11-02 · CVE-2021-38399

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Honeywell Experion PKS versions C200, C200E, C300, and ACE controllers

Description The issue is related to insufficient restrictions on directory path names in the operating system of Honeywell's industrial portable computers. This can be exploited by a remote attacker to perform cross-site scripting attacks, potentially allowing access to unauthorized files and directories.

Recommendations For Honeywell Experion PKS C200, C200E, C300, and ACE controllers, consider restricting access to sensitive directories and files as a temporary mitigation measure until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2021-04949

CVE-2021-38399

Affected Products

Honeywell Experion Pks

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-38399 · Security Note
• https://bdu.fstec.ru/vul/2021-04949 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-278-04 · Note
• https://t.me/cibsecurity/52190 · Telegram Post
• https://t.me/true_secator/2185 · Telegram Post
• https://honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf · Note
• https://securitylab.ru/news/525334.php · Note
• https://ics-cert.us-cert.gov/advisories/icsa-21-278-04 · Note
• https://t.me/thehackernews/1565 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021100608 · Note