title: Honeywell Experion PKS and ACE Controllers Injection
description: Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
problem types: CWE-74: Injection
affected:
{
vendor: Honeywell
product: Experion PKS
versions:
version: C200, status: affected
version: C200E, status: affected
version: C300, status: affected
version: ACE controllers, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
]
workarounds: Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.
Additional information can be found in Honeywell Support document SN2021-02-22-01.