CVE-2021-38399: Honeywell Experion PKS and ACE Controllers Relative Path Traversal
First published: Fri Oct 28 2022(Updated: )
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Honeywell C200 | ||
| Honeywell C200E | ||
| Honeywell C300 and ACE controllers | ||
| Honeywell C200 Firmware | ||
| Honeywell C200 | ||
| Honeywell C200e Firmware | ||
| Honeywell C200E | ||
| Honeywell C300 Firmware | ||
| Honeywell C300 | ||
| Honeywell Application Control Environment Firmware | ||
| Honeywell Application Control Environment |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-38399.
What is the severity of CVE-2021-38399?
The severity of CVE-2021-38399 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2021-38399?
Honeywell Experion PKS C200, C200E, C300, and ACE controllers with specific firmware versions are affected by CVE-2021-38399.
What is the risk of the vulnerability?
The vulnerability may allow an attacker to access unauthorized files and directories.
Are there any fixes or patches available for CVE-2021-38399?
To address the vulnerability, it is recommended to follow the mitigation steps provided by Honeywell as mentioned in their notification.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/honeywell
- canonical/honeywell c200
- canonical/honeywell c200e
- canonical/honeywell c300 and ace controllers
- canonical/honeywell c200 firmware
- canonical/honeywell c200e firmware
- canonical/honeywell c300 firmware
- canonical/honeywell c300
- canonical/honeywell application control environment firmware
- canonical/honeywell application control environment