CVE-2021-38395

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Oct 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-383966.8The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An CVE-2021-3839710.0Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to unrestricted file uploads, which may allow an attacker to re CVE-2021-383986.8The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker with physical access CVE-2021-383997.5Honeywell Experion PKS C200, C200E, C300, and ACE controllers are vulnerable to relative path traversal, which may allow an attacker access CVE-2021-38408.8A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co CVE-2021-384006.8An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create a specially crafted CVE-2021-384017.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an untrusted pointer dereference, which may allo CVE-2021-384027.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th CVE-2021-384034.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi CVE-2021-384047.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th CVE-2021-384057.8The Datalogics APDFL library used in affected products is vulnerable to memory corruption condition while parsing specially crafted PDF file CVE-2021-384067.8Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. Th