PT-2021-4327 · Honeywell · Honeywell Experion Pks

Nadav Erez + 1 · Published 2021-10-06 · Updated 2022-11-02 · CVE-2021-38397

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Honeywell Experion PKS versions C200, C200E, C300, and ACE

Description The issue is related to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition. This could potentially enable an attacker to disrupt the system's operation.

Recommendations For Honeywell Experion PKS versions C200, C200E, C300, and ACE, consider restricting file uploads to prevent remote execution of arbitrary code until a patch is available. As a temporary workaround, restrict access to file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-04951

CVE-2021-38397

Affected Products

Honeywell Experion Pks

References · 10

• https://bdu.fstec.ru/vul/2021-04951 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-38397 · Security Note
• https://t.me/true_secator/2185 · Telegram Post
• https://honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf · Note
• https://securitylab.ru/news/525334.php · Note
• https://ics-cert.us-cert.gov/advisories/icsa-21-278-04 · Note
• https://t.me/thehackernews/1565 · Telegram Post
• https://t.me/cibsecurity/52195 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021100608 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-278-04 · Note