PT-2025-29158 · Honeywell · Fim8+10

Positive Technologies · Published 2025-03-12 · Updated 2025-07-11 · CVE-2025-2521

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions 520.1 through 520.2 TCU9 Honeywell Experion PKS versions 530 through 530 TCU3 Honeywell OneWireless WDM versions 322.1 through 322.4 Honeywell OneWireless WDM versions 330.1 through 330.3

Description: The Honeywell Experion PKS and OneWireless WDM contain a memory buffer vulnerability in the Control Data Access (CDA) component. This vulnerability could allow an attacker to perform an overread of buffers, potentially leading to improper index validation against buffer borders and resulting in remote code execution. The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E.

Recommendations: Honeywell Experion PKS versions 520.1 through 520.2 TCU9: Update to 520.2 TCU9 HF1. Honeywell Experion PKS versions 530 through 530 TCU3: Update to 530.1 TCU3 HF1. Honeywell OneWireless WDM versions 322.1 through 322.4: Update to 322.5. Honeywell OneWireless WDM versions 330.1 through 330.3: Update to 331.1.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2025-06920

CVE-2025-2521

Affected Products

C200E

C300 Pcnt02

C300 Pcnt05

C300Pm

Cn100

Experion Pks

Fim4

Fim8

Hca

Onewireless Wdm

Uoc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-2521 · Security Note
• https://bdu.fstec.ru/vul/2025-06920 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-205-03 · Note
• https://twitter.com/CVEnew/status/1943668189604491700 · Twitter Post
• https://process.honeywell.com · Note