CRITICAL🇵🇱 Wersja polska

CVE-2021-38397

CVSS 10.0v3.1pub. 2022-10-28upd. 2024-11-21

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Honeywell Application Control Environment

    HW
    Honeywell
    all versions

  • Honeywell Application Control Environment Firmware

    OS
    Honeywell
    all versions

  • Honeywell C200

    HW
    Honeywell
    all versions

  • Honeywell C200e

    HW
    Honeywell
    all versions

  • Honeywell C200e Firmware

    OS
    Honeywell
    all versions

  • Honeywell C200 Firmware

    OS
    Honeywell
    all versions

  • Honeywell C300

    HW
    Honeywell
    all versions

  • Honeywell C300 Firmware

    OS
    Honeywell
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2023-24480CRITICAL9.8PL ✓same product

Przepełnienie stosu (stack overflow) w sterowniku Honeywell C300

CVE-2023-25178CRITICAL9.8PL ✓same product

RCE poprzez złośliwy firmware w Honeywell C300

CVE-2023-25770CRITICAL9.8PL ✓same product

Honeywell C300: buffer overflow prowadzący do DoS kontrolera

CVE-2021-38395CRITICAL9.1PL ✓same product

RCE i DoS w sterownikach Honeywell Experion PKS poprzez injection w danych wyjściowych

CVE-2023-26597HIGH7.5same product

Controller DoS due to buffer overflow in the handling of a specially crafted message received by the controlle...