CVE-2025-2520 (GCVE-0-2025-2520)
Vulnerability from cvelistv5
Published
2025-07-10 19:54
Modified
2025-08-04 19:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-457 - Use of Uninitialized Variable
Summary
The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.
Honeywell recommends updating to the most recent version of
Honeywell Experion PKS: 520.2 TCU9 HF1and 530.1 TCU3 HF1. The affected Experion PKS products are
C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
References
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
► | Honeywell | C300 PCNT02 |
Version: 520.1 ≤ 520.2 TCU9 Version: 530 ≤ 530 TCU3 |
||||||||||||||||||||||||||||||||||||||||||||||
|
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2025-2520", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-07-10T20:33:19.670618Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-07-10T20:33:30.482Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "C300 PCNT02", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "EHB", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "EHPM", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "ELMM", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "Classic ENIM", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "ETN", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "FIM4", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "FIM8", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "PGM", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "platforms": [ "Experion PKS" ], "product": "RFIM", "vendor": "Honeywell", "versions": [ { "lessThanOrEqual": "520.2 TCU9", "status": "affected", "version": "520.1", "versionType": "semver" }, { "lessThanOrEqual": "530 TCU3", "status": "affected", "version": "530", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Demid Uzenkov and Kirill Kutaev (Positive Technologies)" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Honeywell Experion PKS contains an \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUninitialized Variable i\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003en the common Epic Platform Analyzer (EPA) communications\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a d\u003c/span\u003eereferencing of an uninitialized pointer leading to a denial of service.\u003cbr\u003e\u003cbr\u003e\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u0026nbsp;530.1 TCU3 HF1.\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe affected Experion PKS products are \n\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\u0026nbsp;from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u003c/span\u003e\u003cbr\u003e" } ], "value": "The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.\n\n\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u00a0530.1 TCU3 HF1.\u00a0The affected Experion PKS products are \n\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\u00a0from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3." } ], "impacts": [ { "capecId": "CAPEC-216", "descriptions": [ { "lang": "en", "value": "CAPEC-216 Communication Channel Manipulation" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-457", "description": "CWE-457 Use of Uninitialized Variable", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-08-04T19:44:48.506Z", "orgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "shortName": "Honeywell" }, "references": [ { "url": "https://process.honeywell.com/" } ], "source": { "discovery": "EXTERNAL" }, "title": "Dereferencing of an uninitialized pointer leads to denial of service.", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "0dc86260-d7e3-4e81-ba06-3508e030ce8d", "assignerShortName": "Honeywell", "cveId": "CVE-2025-2520", "datePublished": "2025-07-10T19:54:35.250Z", "dateReserved": "2025-03-19T13:57:27.868Z", "dateUpdated": "2025-08-04T19:44:48.506Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2025-2520\",\"sourceIdentifier\":\"psirt@honeywell.com\",\"published\":\"2025-07-10T20:15:24.127\",\"lastModified\":\"2025-07-15T13:14:49.980\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.\\n\\n\\n\\nHoneywell recommends updating to the most recent version of \\n\\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u00a0530.1 TCU3 HF1.\u00a0The affected Experion PKS products are \\n\\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\u00a0from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\"},{\"lang\":\"es\",\"value\":\"Honeywell Experion PKS contiene una variable no inicializada en las comunicaciones comunes del Analizador de Plataforma \u00c9pica (EPA). Un atacante podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda una manipulaci\u00f3n del canal de comunicaci\u00f3n, lo que resultar\u00eda en la desreferenciaci\u00f3n de un puntero no inicializado, lo que provocar\u00eda una denegaci\u00f3n de servicio. Honeywell recomienda actualizar a la versi\u00f3n m\u00e1s reciente de Honeywell Experion PKS: 520.2 TCU9 HF1 y 530.1 TCU3 HF1. Los productos Experion PKS afectados son C300 PCNT02, EHB, EHPM, ELMM, ENIM Cl\u00e1sico, ETN, FIM4, FIM8, PGM y RFIM. Las versiones de Experion PKS afectadas son de la 520.1 a la 520.2 TCU9 y de la 530 a la 530 TCU3.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@honeywell.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"psirt@honeywell.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-457\"}]}],\"references\":[{\"url\":\"https://process.honeywell.com/\",\"source\":\"psirt@honeywell.com\"}]}}", "vulnrichment": { "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-2520\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-10T20:33:19.670618Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-10T20:33:27.000Z\"}}], \"cna\": {\"title\": \"Dereferencing of an uninitialized pointer leads to denial of service.\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Demid Uzenkov and Kirill Kutaev (Positive Technologies)\"}], \"impacts\": [{\"capecId\": \"CAPEC-216\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-216 Communication Channel Manipulation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Honeywell\", \"product\": \"C300 PCNT02\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"EHB\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"EHPM\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"ELMM\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"Classic ENIM\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"ETN\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"FIM4\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"FIM8\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"PGM\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Honeywell\", \"product\": \"RFIM\", \"versions\": [{\"status\": \"affected\", \"version\": \"520.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"520.2 TCU9\"}, {\"status\": \"affected\", \"version\": \"530\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"530 TCU3\"}], \"platforms\": [\"Experion PKS\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://process.honeywell.com/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.\\n\\n\\n\\nHoneywell recommends updating to the most recent version of \\n\\nHoneywell Experion PKS: 520.2 TCU9 HF1and\\u00a0530.1 TCU3 HF1.\\u00a0The affected Experion PKS products are \\n\\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\\u00a0from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe Honeywell Experion PKS contains an \u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eUninitialized Variable i\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003en the common Epic Platform Analyzer (EPA) communications\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a d\u003c/span\u003eereferencing of an uninitialized pointer leading to a denial of service.\u003cbr\u003e\u003cbr\u003e\\n\\nHoneywell recommends updating to the most recent version of \\n\\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u0026nbsp;530.1 TCU3 HF1.\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThe affected Experion PKS products are \\n\\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are\u0026nbsp;from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-457\", \"description\": \"CWE-457 Use of Uninitialized Variable\"}]}], \"providerMetadata\": {\"orgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"shortName\": \"Honeywell\", \"dateUpdated\": \"2025-08-04T19:44:48.506Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2025-2520\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-04T19:44:48.506Z\", \"dateReserved\": \"2025-03-19T13:57:27.868Z\", \"assignerOrgId\": \"0dc86260-d7e3-4e81-ba06-3508e030ce8d\", \"datePublished\": \"2025-07-10T19:54:35.250Z\", \"assignerShortName\": \"Honeywell\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…