CVE-2025-2523
published 2025-07-10CVE-2025-2523: The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could…
PriorityP265critical9.4CVSS 3.1
AVNACLPRNUINSUCLIHAH
EPSS
0.69%
47.9th percentile
The Honeywell Experion PKS
and OneWireless WDM
contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure during subtraction allowing remote code execution.
Honeywell recommends updating to the most recent version of
Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| honeywell | c200e | 520.1 – 520.2 TCU9 | — |
| honeywell | c200e | 530 – 530 TCU3 | — |
| honeywell | c300_pcnt02 | 520.1 – 520.2 TCU9 | — |
| honeywell | c300_pcnt02 | 530 – 530 TCU3 | — |
| honeywell | c300_pcnt05 | 520.1 – 520.2 TCU9 | — |
| honeywell | c300_pcnt05 | 530 – 530 TCU3 | — |
| honeywell | c300pm | 520.1 – 520.2 TCU9 | — |
| honeywell | c300pm | 530 – 530 TCU3 | — |
| honeywell | cn100 | 520.1 – 520.2 TCU9 | — |
| honeywell | cn100 | 530 – 530 TCU3 | — |
| honeywell | fim4 | 520.1 – 520.2 TCU9 | — |
| honeywell | fim4 | 530 – 530 TCU3 | — |
| honeywell | fim8 | 520.1 – 520.2 TCU9 | — |
| honeywell | fim8 | 530 – 530 TCU3 | — |
| honeywell | hca | 520.1 – 520.2 TCU9 | — |
| honeywell | hca | 530 – 530 TCU3 | — |
| honeywell | uoc | 520.1 – 520.2 TCU9 | — |
| honeywell | uoc | 530 – 530 TCU3 | — |
| honeywell | wireless_device_manager | 322.1 – 322.4 | — |
| honeywell | wireless_device_manager | 330.1 – 330.3 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Target component is Control Data Access (CDA) in Honeywell OneWireless WDM and Experion PKS; exploit triggers an integer underflow (wrap/wraparound) during a subtraction operation in the CDA communication channel, leading to RCE. ↗
- →Exploit is network-reachable with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N); monitor for unexpected or malformed CDA protocol traffic from external/untrusted network segments. ↗
- →Affected products include C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E running Experion PKS 520.1–520.2 TCU9 or 530–530 TCU3, and OneWireless WDM 322.1–322.4 or 330.1–330.3; presence of these versions on internet-accessible segments is a high-risk indicator. ↗
- ·No public exploit or proof-of-concept has been reported; CISA states no known public exploitation specifically targeting these vulnerabilities at time of advisory publication. ↗
- ·The advisory covers four CVEs (CVE-2025-2521, CVE-2025-2522, CVE-2025-2523, CVE-2025-3946) all sharing the same CDA component; detection efforts targeting CVE-2025-2523 (integer underflow) may overlap with the other three vulnerabilities and should be scoped accordingly. ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Honeywell OneWireless Wireless Device Manager (WDM)
cisa_ics·2025-09-04·CVSS 8.6
[HIGH] Honeywell OneWireless Wireless Device Manager (WDM)
ICS Advisory
##
Honeywell OneWireless Wireless Device Manager (WDM)
Release DateSeptember 04, 2025
Alert CodeICSA-25-247-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Honeywell
- Equipment: OneWireless Wireless Device Manager (WDM)
- Vulnerabilities: Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.
CISA ICS
Honeywell Experion PKS (Update A)
cisa_ics·2025-09-04·CVSS 7.5
[HIGH] Honeywell Experion PKS (Update A)
ICS Advisory
##
Honeywell Experion PKS (Update A)
Last RevisedSeptember 04, 2025
Alert CodeICSA-25-205-03
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Honeywell
- Equipment: Experion PKS
- Vulnerabilities: Use of Uninitialized Variable, Improper Restriction of Operations within the Bounds of a Memory Buffer, Sensitive Information in Resource Not Removed Before Reuse, Integer Underflow (Wrap or Wraparound), Deployment of Wrong Handler
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could result in information exposure, denial of service, or remote code execution.
## 3. TECHNICAL
GHSA
GHSA-pq3m-8f73-633p: The Honeywell Experion PKS
and OneWireless WDM
contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA)
ghsa_unreviewed·2025-07-10
CVE-2025-2523 [CRITICAL] CWE-191 GHSA-pq3m-8f73-633p: The Honeywell Experion PKS
and OneWireless WDM
contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA)
The Honeywell Experion PKS
and OneWireless WDM
contains an Integer Underflow
vulnerability
in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure during subtraction allowing remote code execution.
Honeywell recommends updating to the most recent version of
Honeywell Experion PKS:520.2 TCU9 HF1 and 530.1 TCU3 HF1 and OneWireless: 322.5 and 331.1.
The affected Experion PKS products are C300 PCNT02, C300 PCNT05, FIM4, FIM8, UOC, CN100, HCA, C300PM, and C200E. The Experion PKS versions affected are from 520.1 through 520.2 TCU9 and from 530 through 530 TCU3. The OneWireless WDM affected versions are 322.1 through 322.4 and 330.1 through 330.3.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-10
Published