PT-2021-4326 · Honeywell · Honeywell Experion Pks

Nadav Erez + 1 · Published 2021-10-06 · Updated 2025-07-31 · CVE-2021-38395

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Honeywell Experion PKS versions C200, C200E, C300, and ACE controllers

Description The issue exists due to improper neutralization of special elements. This may allow a remote attacker to execute arbitrary code and cause a denial-of-service condition, potentially through cross-site scripting attacks.

Recommendations For Honeywell Experion PKS C200, C200E, C300, and ACE controllers, update to a version that properly neutralizes special elements in output to prevent arbitrary code execution and denial-of-service conditions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2021-04950

CVE-2021-38395

Affected Products

Honeywell Experion Pks

References · 11

• https://bdu.fstec.ru/vul/2021-04950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38395 · Security Note
• https://twitter.com/dailycve/status/1950940200206536771 · Twitter Post
• https://t.me/true_secator/2185 · Telegram Post
• https://honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf · Note
• https://securitylab.ru/news/525334.php · Note
• https://ics-cert.us-cert.gov/advisories/icsa-21-278-04 · Note
• https://t.me/thehackernews/1565 · Telegram Post
• https://t.me/cibsecurity/52189 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021100608 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-278-04 · Note