fkie_cve-2025-2520
Vulnerability from fkie_nvd
Published
2025-07-10 20:15
Modified
2025-07-15 13:14
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service. Honeywell recommends updating to the most recent version of Honeywell Experion PKS: 520.2 TCU9 HF1and 530.1 TCU3 HF1. The affected Experion PKS products are C300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3.
References
psirt@honeywell.comhttps://process.honeywell.com/
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.\n\n\n\nHoneywell recommends updating to the most recent version of \n\nHoneywell Experion PKS: 520.2 TCU9 HF1and\u00a0530.1 TCU3 HF1.\u00a0The affected Experion PKS products are \n\nC300 PCNT02, EHB, EHPM, ELMM, Classic ENIM, ETN, FIM4, FIM8, PGM, and RFIM.  The Experion PKS versions affected are\u00a0from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3."
    },
    {
      "lang": "es",
      "value": "Honeywell Experion PKS contiene una variable no inicializada en las comunicaciones comunes del Analizador de Plataforma \u00c9pica (EPA). Un atacante podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda una manipulaci\u00f3n del canal de comunicaci\u00f3n, lo que resultar\u00eda en la desreferenciaci\u00f3n de un puntero no inicializado, lo que provocar\u00eda una denegaci\u00f3n de servicio. Honeywell recomienda actualizar a la versi\u00f3n m\u00e1s reciente de Honeywell Experion PKS: 520.2 TCU9 HF1 y 530.1 TCU3 HF1. Los productos Experion PKS afectados son C300 PCNT02, EHB, EHPM, ELMM, ENIM Cl\u00e1sico, ETN, FIM4, FIM8, PGM y RFIM. Las versiones de Experion PKS afectadas son de la 520.1 a la 520.2 TCU9 y de la 530 a la 530 TCU3."
    }
  ],
  "id": "CVE-2025-2520",
  "lastModified": "2025-07-15T13:14:49.980",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "psirt@honeywell.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-10T20:15:24.127",
  "references": [
    {
      "source": "psirt@honeywell.com",
      "url": "https://process.honeywell.com/"
    }
  ],
  "sourceIdentifier": "psirt@honeywell.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-457"
        }
      ],
      "source": "psirt@honeywell.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.