CVE-2021-38395
criticalpriority · track · 39EPSS 0.012 · 67 %ileEURUUSEPSS · scored 2026-10-27
Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationC200cisa_csaf_ot
Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.
https://www.honeywellprocess.com/library/support/Documents/Experion/Network-and-Security-Planning-Guide-EPDOC-XX75-en-511C.pdf - MitigationC200Ecisa_csaf_ot
Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.
https://www.honeywellprocess.com/library/support/Documents/Experion/Network-and-Security-Planning-Guide-EPDOC-XX75-en-511C.pdf - MitigationC300 and ACE controllerscisa_csaf_ot
Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.
https://www.honeywellprocess.com/library/support/Documents/Experion/Network-and-Security-Planning-Guide-EPDOC-XX75-en-511C.pdf
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (17)
Products and version ranges known to be affected.
- honeywell application control environment firmwareall versionsnvdUScpe:2.3:o:honeywell:application_control_environment_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-21-278-04Honeywell Experion PKS and ACE Controllers2021-10-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could lead to remote code execution and denial-of-service conditions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2021-38395/cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-278-04cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.3308cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021100608cnnvd
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdfcnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-278-04enisa_euvd
- https://www.honeywellprocess.com/library/support/notifications/Customer/SN2021-02-22-01-Experion-C300-CCL.pdfenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan