Vulnerability Description
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | C200 Firmware | - |
| Honeywell | C200 | - |
| Honeywell | C200E Firmware | - |
| Honeywell | C200E | - |
| Honeywell | C300 Firmware | - |
| Honeywell | C300 | - |
| Honeywell | Application Control Environment Firmware | - |
| Honeywell | Application Control Environment | - |
Related Weaknesses (CWE)
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04MitigationThird Party AdvisoryUS Government Resource
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-0Product
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04MitigationThird Party AdvisoryUS Government Resource
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-0Product
FAQ
What is CVE-2021-38395?
CVE-2021-38395 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code an...
How severe is CVE-2021-38395?
CVE-2021-38395 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-38395?
Check the references section above for vendor advisories and patch information. Affected products include: Honeywell C200 Firmware, Honeywell C200, Honeywell C200E Firmware, Honeywell C200E, Honeywell C300 Firmware.