CVE-2021-38397 - Vulnerability Details - OpenCVE

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Honeywell	Application Control Environment Application Control Environment Firmware C200 C200 Firmware C200e C200e Firmware C300 C300 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:honeywell:c200_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:c200:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:honeywell:c200e_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:c200e:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:honeywell:c300_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:c300:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:honeywell:application_control_environment_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honeywell:application_control_environment:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04
https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf

History

Wed, 16 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-10-28T01:21:35.576Z

Updated: 2025-04-16T16:07:44.758Z

Reserved: 2021-08-10T00:00:00.000Z

Link: CVE-2021-38397

Vulnrichment

Updated: 2024-08-04T01:37:16.577Z

NVD

Status : Modified

Published: 2022-10-28T02:15:16.953

Modified: 2024-11-21T06:16:59.800

Link: CVE-2021-38397

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-38397", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "datePublished": "2022-10-28T01:21:35.576Z", "dateUpdated": "2025-04-16T16:07:44.758Z", "dateReserved": "2021-08-10T00:00:00.000Z"}, "containers": {"cna": {"title": "Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type", "datePublic": "2021-10-05T00:00:00.000Z", "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-10-28T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition."}], "affected": [{"vendor": "Honeywell", "product": "Experion PKS", "versions": [{"version": "C200", "status": "affected"}, {"version": "C200E", "status": "affected"}, {"version": "C300", "status": "affected"}, {"version": "ACE controllers", "status": "affected"}]}], "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04"}, {"url": "https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf"}], "credits": [{"lang": "en", "value": "Rei Henigman and Nadav Erez of Claroty reported these vulnerabilities to CISA."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"discovery": "EXTERNAL"}, "workarounds": [{"lang": "en", "value": "Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.\n\nAdditional information can be found in Honeywell Support document SN2021-02-22-01."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:37:16.577Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04", "tags": ["x_transferred"]}, {"url": "https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T15:53:15.692298Z", "id": "CVE-2021-38397", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T16:07:44.758Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04", "tags": ["x_transferred"]}, {"url": "https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:37:16.577Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-38397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T15:53:15.692298Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T15:53:17.504Z"}}], "cna": {"title": "Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Rei Henigman and Nadav Erez of Claroty reported these vulnerabilities to CISA."}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Honeywell", "product": "Experion PKS", "versions": [{"status": "affected", "version": "C200"}, {"status": "affected", "version": "C200E"}, {"status": "affected", "version": "C300"}, {"status": "affected", "version": "ACE controllers"}]}], "datePublic": "2021-10-05T00:00:00.000Z", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04"}, {"url": "https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf"}], "workarounds": [{"lang": "en", "value": "Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.\n\nAdditional information can be found in Honeywell Support document SN2021-02-22-01."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-10-28T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2021-38397", "state": "PUBLISHED", "dateUpdated": "2025-04-16T16:07:44.758Z", "dateReserved": "2021-08-10T00:00:00.000Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2022-10-28T01:21:35.576Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:c200_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "89205AE1-0EE7-4665-8FE6-5312EAD5FB2D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:c200:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3F154A3-2438-4420-8B6E-E0521376714E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:c200e_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B06800D-443D-4237-8E91-98735E5EA148", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:c200e:-:*:*:*:*:*:*:*", "matchCriteriaId": "6ACB0AD6-5A19-4DEC-9F47-03EC6FA80AC0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:c300_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C79B7D1-630B-4723-BFCA-66F03F93D1FB", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:c300:-:*:*:*:*:*:*:*", "matchCriteriaId": "CEA14D67-E320-490E-92E6-CC135EBBA245", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honeywell:application_control_environment_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "83F4F4B6-E05B-43B9-96ED-02919E42AFCC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honeywell:application_control_environment:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C79B55A-11AB-441E-A544-9678616E9BA4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition."}, {"lang": "es", "value": "Los controladores Honeywell Experion PKS C200, C200E, C300 y ACE son vulnerables a la carga de archivos sin restricciones, lo que puede permitir a un atacante ejecutar c\u00f3digo arbitrario de forma remota y provocar una condici\u00f3n de Denegaci\u00f3n de Servicio."}], "id": "CVE-2021-38397", "lastModified": "2024-11-21T06:16:59.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-28T02:15:16.953", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}