Vulnerability Description
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | C200 Firmware | - |
| Honeywell | C200 | - |
| Honeywell | C200E Firmware | - |
| Honeywell | C200E | - |
| Honeywell | C300 Firmware | - |
| Honeywell | C300 | - |
| Honeywell | Application Control Environment Firmware | - |
| Honeywell | Application Control Environment | - |
Related Weaknesses (CWE)
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04Third Party AdvisoryUS Government Resource
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-0Product
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04Third Party AdvisoryUS Government Resource
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-0Product
FAQ
What is CVE-2021-38397?
CVE-2021-38397 is a vulnerability with a CVSS score of 10.0 (CRITICAL). Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service ...
How severe is CVE-2021-38397?
CVE-2021-38397 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-38397?
Check the references section above for vendor advisories and patch information. Affected products include: Honeywell C200 Firmware, Honeywell C200, Honeywell C200E Firmware, Honeywell C200E, Honeywell C300 Firmware.