CRITICAL🇵🇱 Wersja polska

CVE-2021-38395

CVSS 9.1v3.1pub. 2022-10-28upd. 2024-11-21

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Honeywell Application Control Environment

    HW
    Honeywell
    all versions

  • Honeywell Application Control Environment Firmware

    OS
    Honeywell
    all versions

  • Honeywell C200

    HW
    Honeywell
    all versions

  • Honeywell C200e

    HW
    Honeywell
    all versions

  • Honeywell C200e Firmware

    OS
    Honeywell
    all versions

  • Honeywell C200 Firmware

    OS
    Honeywell
    all versions

  • Honeywell C300

    HW
    Honeywell
    all versions

  • Honeywell C300 Firmware

    OS
    Honeywell
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-24480CRITICAL9.8PL ✓same product

Przepełnienie stosu (stack overflow) w sterowniku Honeywell C300

CVE-2023-25178CRITICAL9.8PL ✓same product

RCE poprzez złośliwy firmware w Honeywell C300

CVE-2023-25770CRITICAL9.8PL ✓same product

Honeywell C300: buffer overflow prowadzący do DoS kontrolera

CVE-2021-38397CRITICAL10.0PL ✓same product

Unrestricted file upload w kontrolerach Honeywell Experion PKS umożliwia RCE

CVE-2023-26597HIGH7.5same product

Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controlle...