title: Honeywell Experion PKS and ACE Controllers Unrestricted Upload of File with Dangerous Type
description: Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.
problem types: CWE-434: Unrestricted Upload of File with Dangerous Type
affected:
{
vendor: Honeywell
product: Experion PKS
versions:
version: C200, status: affected
version: C200E, status: affected
version: C300, status: affected
version: ACE controllers, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
]
workarounds: Honeywell recommends users follow all guidance in the Experion Network and Security Planning Guide to prevent attacks by malicious actors.
Additional information can be found in Honeywell Support document SN2021-02-22-01.