CVE-2021-38397: Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
First published: Fri Oct 28 2022(Updated: )
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell C200 | ||
| Honeywell C200E | ||
| Honeywell C300 and ACE controllers | ||
| Honeywell C200 Firmware | ||
| Honeywell C200 | ||
| Honeywell C200e Firmware | ||
| Honeywell C200E | ||
| Honeywell C300 Firmware | ||
| Honeywell C300 | ||
| Honeywell Application Control Environment Firmware | ||
| Honeywell Application Control Environment |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-38397.
What is the severity of CVE-2021-38397?
The severity of CVE-2021-38397 is critical with a severity value of 10.
Which Honeywell controllers are affected by CVE-2021-38397?
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are affected by CVE-2021-38397.
What is the impact of CVE-2021-38397?
CVE-2021-38397 may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
How can I fix the vulnerability CVE-2021-38397?
To fix the vulnerability CVE-2021-38397, it is recommended to apply the patches and updates provided by Honeywell.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/honeywell
- canonical/honeywell c200
- canonical/honeywell c200e
- canonical/honeywell c300 and ace controllers
- canonical/honeywell c200 firmware
- canonical/honeywell c200e firmware
- canonical/honeywell c300 firmware
- canonical/honeywell c300
- canonical/honeywell application control environment firmware
- canonical/honeywell application control environment