Vulnerability Description
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Honeywell | C200 Firmware | - |
| Honeywell | C200 | - |
| Honeywell | C200E Firmware | - |
| Honeywell | C200E | - |
| Honeywell | C300 Firmware | - |
| Honeywell | C300 | - |
| Honeywell | Application Control Environment Firmware | - |
| Honeywell | Application Control Environment | - |
Related Weaknesses (CWE)
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04Third Party AdvisoryUS Government Resource
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-0Product
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04Third Party AdvisoryUS Government Resource
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-0Product
FAQ
What is CVE-2021-38399?
CVE-2021-38399 is a vulnerability with a CVSS score of 7.5 (HIGH). Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.
How severe is CVE-2021-38399?
CVE-2021-38399 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-38399?
Check the references section above for vendor advisories and patch information. Affected products include: Honeywell C200 Firmware, Honeywell C200, Honeywell C200E Firmware, Honeywell C200E, Honeywell C300 Firmware.