What’s Vulnerable › Vulnerabilities

CVE-2021-38395: Honeywell Experion PKS and ACE Controllers Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-28 · updated 2026-06-17
• Weakness: CWE-74

Description

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

Affected products

• Honeywell Application Control Environment Firmware: all versions
• Honeywell C200 Firmware: all versions
• Honeywell C200E Firmware: all versions
• Honeywell C300: all versions

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04
• https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04
• https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdf

Get alerted when CVE-2021-38395 or the next vulnerability affects your stack