CVE-2021-38395: Honeywell Experion PKS and ACE Controllers Injection
First published: Fri Oct 28 2022(Updated: )
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell C200 | ||
| Honeywell C200E | ||
| Honeywell C300 and ACE controllers | ||
| Honeywell C200 Firmware | ||
| Honeywell C200 | ||
| Honeywell C200e Firmware | ||
| Honeywell C200E | ||
| Honeywell C300 Firmware | ||
| Honeywell C300 | ||
| Honeywell Application Control Environment Firmware | ||
| Honeywell Application Control Environment |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-38395?
CVE-2021-38395 is a vulnerability found in Honeywell Experion PKS C200, C200E, C300, and ACE controllers, which allows remote execution of arbitrary code and can cause a denial-of-service condition.
How severe is CVE-2021-38395?
CVE-2021-38395 is considered a critical vulnerability with a severity score of 9.8 out of 10.
Which software is affected by CVE-2021-38395?
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are affected by CVE-2021-38395.
How can an attacker exploit CVE-2021-38395?
An attacker can exploit CVE-2021-38395 by sending specially crafted input to the affected controllers, allowing them to execute arbitrary code remotely.
Are there any recommended fixes for CVE-2021-38395?
Yes, it is recommended to apply the necessary patches or updates provided by Honeywell to mitigate CVE-2021-38395.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/honeywell
- canonical/honeywell c200
- canonical/honeywell c200e
- canonical/honeywell c300 and ace controllers
- canonical/honeywell c200 firmware
- canonical/honeywell c200e firmware
- canonical/honeywell c300 firmware
- canonical/honeywell c300
- canonical/honeywell application control environment firmware
- canonical/honeywell application control environment