CVE-2021-38397
Assigner: icscert
Published: 2021-10-05T00:00:00
State: PUBLISHED
title: Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
datePublic: 2021-10-05T00:00:00
descriptions: value: Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
affected: vendor: Honeywell
product: Experion PKS
versions: version: C200
status: affected
version: C200E
status: affected
version: C300
status: affected
version: ACE controllers
status: affected
credits: value: Rei Henigman and Nadav Erez of Claroty reported these vulnerabilities to CISA.
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
problemTypes: descriptions: type: CWE
description: CWE-434: Unrestricted Upload of File with Dangerous Type
cweId: CWE-434
x_generator: engine: Vulnogram 0.0.9
source: discovery: EXTERNAL
workarounds: value: Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.

Additional information can be found in Honeywell Support document SN2021-02-22-01.